Architecture Health Check

Direct PostgreSQL/MySQL connections. Occasional slow queries (200ms–1s) or connection spike warnings.

Frequent 504 timeouts, serverless connection exhaustion, or unindexed full-table scans.

Components are typed, but API payloads and database responses often bypass validation with 'any'.

Frequent runtime crashes ('Cannot read property of undefined') in production logs.

Webhooks do heavy database/email work before replying. Occasional dropped events during spikes.

No HMAC signature checking, no deduplication, lost customer events during server restarts.

Noticeable script bloat, unoptimized images, or occasional layout jumping during hydration.

Large monolithic bundles, uncompressed assets, and poor mobile lighthouse scores (<50).

Isolation relies entirely on developers remembering to add WHERE tenant_id to every single query.

Tokens vulnerable to XSS, no CSRF protection, or shared database credentials across roles.

Pushes straight to production. Regressions and typos occasionally slip directly to live customers.

No version control audit trail, fragile manual file copying, zero rollback capability.