🗂️ Technical Due Diligence — Midshift
🗂️ Technical Due Diligence — Midshift
Key
| Rating | Severity | Status |
|---|---|---|
| 🟢 Green — 4 to 5 | 🔴 Critical | ✅ Yes |
| 🟡 Amber — 3 | 🟠 High | ❌ No |
| 🔴 Red — 1 to 2 | 🟡 Medium | ◐ Partial |
| ●●●○○ — score out of 5 | ⚪ Low |
Assessment of the midshift-audit repository (single commit 3789df6, "Midshift source for audit", 2026-10-06), carried out 2026-10-07. Start with the executive summary.
🔴 ●●○○○ Overall: 2 / 5 — Red (as delivered); 3 / 5 Amber once the two Critical S-effort fixes are deployed and verified.
| File | Module | Rating | RAG | Top risk |
|---|---|---|---|---|
| 14-executive-summary.md | Executive Summary & Overall Assessment | ●●○○○ 2 / 5 | 🔴 Red | Self-promotion to admin via users RLS policy 🔴 (Critical) |
| 01-product-overview.md | Product & Domain Overview | ●●●●○ 4 / 5 | 🟢 Green | Single-tenant deployment model limits a SaaS scale thesis 🟠 (High if that is the thesis) |
| 02-tech-stack.md | Technology Stack & Codebase Complexity | ●●●○○ 3 / 5 | 🟡 Amber | Next.js exact-pinned at 16.2.0 with critical advisories 🔴 (Critical) |
| 03-architecture.md | Architecture & Design | ●●●○○ 3 / 5 | 🟡 Amber | Browser-side writes bypass server-side discipline and approval-reset rules 🟠 (High) |
| 04-domain-and-business-rules.md | Domain Model & Business Rules | ●●●○○ 3 / 5 | 🟡 Amber | Approvals can be left standing or self-granted within a job 🟠 (High) |
| 05-code-quality.md | Code Quality & Standards | ●●●●○ 4 / 5 | 🟢 Green | Complex core write paths with ~1% API test coverage 🟠 (High) |
| 06-technical-debt.md | Technical Debt & Maintainability | ●●●○○ 3 / 5 | 🟡 Amber | Riskiest code (auth, fat handlers) is the least tested 🟠 (High) |
| 07-testing.md | Testing & QA | ●●●○○ 3 / 5 | 🟡 Amber | Routes untested against the real implementation; harness re-implements auth 🟠 (High) |
| 08-dependencies-licensing.md | Dependencies & Licensing | ●●○○○ 2 / 5 | 🔴 Red | Critical Next.js RCE on a used code path; abandoned xlsx parsing uploads 🔴 (Critical) |
| 09-security.md | Security & DevSecOps | ●●○○○ 2 / 5 | 🔴 Red | Any signed-in user can set their own role to admin 🔴 (Critical) |
| 10-dev-practices.md | Source Control, CI/CD & Development Practices | ●●●○○ 3 / 5 | 🟡 Amber | No evidenced code review; no security scanning in CI 🟠 (High) |
| 11-delivery-and-key-person-risk.md | Delivery Metrics & Key-Person Risk | ●○○○○ 1 / 5 | 🔴 Red | Bus factor of one across code, operations and IP 🔴 (Critical) |
| 12-documentation.md | Documentation Review | ●●●○○ 3 / 5 | 🟡 Amber | Fresh-deployment migration instructions are wrong 🟠 (High) |
| 13-integrations.md | Integrations | ●●●○○ 3 / 5 | 🟡 Amber | No monitoring; missing CRON_SECRET silently disables purge and alerts 🟠 (High) |
Evidence conventions: [Observed] verified with a cited file or command; [Inferred] reasoned from indirect evidence; [Unavailable] could not be assessed, with the access needed. The consolidated access-request list is in the executive summary.