Every Amber or Red control from the audit report is one row. Not Verified items live in the report's questions section unless the project owner later confirms them as actual gaps.
| ID | Feature | Control | Gap | State | Priority* | Evidence | Recommended action | Owner | Target date |
|---|---|---|---|---|---|---|---|---|---|
| G1 | Payments | 3.4 | Live-looking Stripe secret key committed to tracked source | Red | 1 | config/settings.py:42, prefix matches sk_live_ | Rotate the key immediately; add secret scanning to CI | ||
| G2 | Account management | 14.2 | Soft-deleted accounts remain queryable via admin search | Red | 1 | src/admin/search.ts:88 — query has no deletedAt IS NULL filter | Add the filter; add a purge job for the underlying rows | ||
| G3 | Deployment & infra | 3.3 | CI runs but is not a required check on the default branch | Red | 4 | Branch protection API: no required status checks configured | Mark the existing test workflow as required | ||
| G4 | Authentication | 5.4 | Login and password-reset flows have unit tests only, no integration coverage | Amber | 5 | tests/auth/ — all specs mock the database layer | Add one integration test exercising the real login flow end to end | ||
| G5 | Notes management | 11.1 | /api/notes list endpoint returns unbounded results | Red | 5 | src/routes/notes.ts:21 — Note.findAll() with no pagination | Add cursor or offset pagination with a sane default page size | ||
| G6 | Notes management | 11.2 | Note tags fetched in a per-item loop instead of a batch query | Amber | 5 | src/routes/notes.ts:35-41 | Batch-load tags with a single join or WHERE IN query | ||
| G7 | Deployment & infra | 9.3 | Sentry installed but project owner confirmed no alert rules are configured | Red | 6 | Owner confirmation, 2026-07-14 | Configure at least an error-rate alert routed to on-call | ||
| G8 | Notes management | 11.4 | No caching on the notes-search endpoint despite a raised timeout in config | Amber | 7 | config/timeouts.yml — search timeout raised from 5s to 15s, no cache layer present | Add a cache layer or precompute the search index | ||
| G9 | Deployment & infra | 12.1 | Public API has no OpenAPI spec or published client | Amber | 7 | No spec file found; routes documented only in code | Publish an OpenAPI spec for the /api/v1/ surface |