Audit Backend

Backend Audit

Audit backend source code for SQL safety, error handling, API contract integrity, and convention violations.

Detection Strategy

Auto-detect the backend stack by scanning for:

• go.mod — Go project
• package.json with Express/Fastify/NestJS — Node.js project
• requirements.txt / pyproject.toml with Flask/FastAPI/Django — Python project
• Cargo.toml — Rust project
• pom.xml / build.gradle — Java project

Identify source directories, handler/controller locations, service layers, and data-access layers.

Checks

1. SQL Injection Risk

Grep for SQL built with string interpolation:

• Go: fmt\.Sprintf.*(?:SELECT|INSERT|UPDATE|DELETE)
• JS/TS: `SELECT.*\$\{|`INSERT.*\$\{|`UPDATE.*\$\{|`DELETE.*\$\{
• Python: f"SELECT|f"INSERT|"SELECT.*".format|%s.*SELECT (outside ORM) FAIL for any SQL built with user input via string interpolation.

2. DELETE without WHERE

Grep DELETE FROM in data-access/repository files and verify each has a WHERE clause. FAIL for any unguarded DELETE statement.

3. Unbounded SELECT on Large Tables

Grep SELECT.*FROM without LIMIT in repository/data-access files. WARN for queries on potentially large tables without pagination or limits.

4. Swallowed Errors

• Go: grep _ = err (excluding test files)
• JS/TS: grep catch\s*\( with empty or log-only bodies
• Python: grep except.*:.*pass$|except.*:.*continue$ WARN for each occurrence — errors should be wrapped or handled.

5. Debug Print Statements

• Go: grep fmt\.Print|log\.Print (should use structured logger like zap/zerolog)
• JS/TS: grep console\.log in server-side code
• Python: grep print( in non-CLI code (should use logging module) WARN with count — should use structured logging.

6. Missing Error Wrapping

Grep for bare error returns without context wrapping:

• Go: return.*err$ without fmt.Errorf or errors.Wrap
• JS/TS: throw err without additional context Sample 5 files. WARN for pattern violations.

7. Stub/NotImplemented Endpoints

Grep NotImplemented|TODO.*endpoint|stub|placeholder in handler/controller files. WARN for each stub that is routable (reachable by clients).

8. Auth Middleware Coverage

Find route registration file(s). Check all endpoints have auth middleware. Identify intentionally public routes (health checks, login, public resources). WARN for any other unprotected endpoint.

9. PII in Public Responses

Scan DTO/response types for sensitive fields: phone, email, password, ssn, lat, lon, secret. FAIL if these appear in DTOs used by public endpoints (listings, search results, public profiles). OK in admin DTOs and self-profile endpoints.

10. Environment Variable Documentation

Extract all environment variable references from source code. Cross-reference against .env.example or equivalent documentation file. WARN for undocumented environment variables.

11. Dead Code

• Grep for unused exports/functions (functions defined but never called from other files)
• Check for commented-out code blocks (more than 3 lines)
• Grep // TODO.*delete|// DEPRECATED|// REMOVE WARN with count and locations.

12. TODO/FIXME/HACK Density

Grep TODO|FIXME|HACK|XXX in source files (excluding tests and vendor). WARN with count per category and locations of the oldest items.

Output Format

[PASS/WARN/FAIL] #N description — details (file:line if applicable)

End with summary: X PASS, Y WARN, Z FAIL and action items list for FAILs.