Engineering Audit — Acme Notes

2026-07-15 · github.com/example/acme-notes (fictional)

Do these first

Payments: Rotate committed Stripe secret key and add secret scanning to CI — G1
Account management: Fix soft-delete so purged accounts stop appearing in admin search — G2
Deployment & infra: Require CI to pass before merge on the default branch — G3
Authentication: Add integration test coverage for the login/reset-password flow — G4
Notes management: Add pagination to the unbounded /api/notes list endpoint — G5

Executive summary, findings by feature, questions, inspection boundary.

Every Amber/Red finding as an actionable row with owner and target date.

What each finding was measured against, as of this audit's date.