The Codebase Health Checklist

1. Deploys & Reliability

• Anyone on the team can deploy to production with a single, documented command or click.
• A failed deploy rolls back automatically or within minutes.
• There is at least one automated smoke test on the critical user flow.
• Environment variables are documented and validated at startup.
• You know within minutes when production breaks (error tracking is wired up).

2. Tests & Confidence

• The money/auth paths have automated test coverage.
• Tests run automatically on every pull request.
• A green build genuinely means it's safe to ship.
• You can refactor a core module without fear of silent breakage.

3. Security & Data

• Secrets live in environment variables, never in the repo.
• User input is validated on the server, not just the client.
• Auth and authorization are enforced on the server for every protected action.
• Database access is scoped so one user cannot read another's data.
• Dependencies are updated regularly and scanned for known vulnerabilities.

4. Structure & Maintainability

• Core business logic lives in one place, not copy-pasted across files.
• A new engineer can find where a feature lives without a guided tour.
• Naming is consistent enough that you can guess file and function names.
• There is no 'do not touch' file that everyone is afraid of.
• Type errors and lint errors block the build instead of being ignored.

5. Process & Knowledge

• There is a README that actually explains how to run the project locally.
• Architecture decisions are written down somewhere, not just in one person's head.
• Work is tracked so you know what's in progress and what's blocked.
• There is a clear owner for production incidents.
• You could survive your most experienced engineer taking a two-week vacation.
• You ship improvements more often than you firefight regressions.

Scoring

20–25 checks: Healthy. Keep doing what you're doing; focus on incremental gains.

12–19 checks: Fragile. You're shipping, but risk is accumulating. Fix the lowest-scoring section first.

Under 12 checks: At risk. The codebase is likely slowing the team down and a structured audit will pay for itself quickly.