A real audit, anonymized. Every number below is produced by the offline
engine (harmonia-ready audit) on a representative repo — not hand-written.
Names and paths are generic; no secret values are ever shown.
Executive summary
SampleApp looks like an AI-built MVP that was never cleaned up. It is not a security disaster of intent — it is the ordinary debris of moving fast: a live secrets file committed to the repo, keys hard-coded in runtime code, and none of the scaffolding that makes software safe to hand off (CI, a real README, a licence). The good news: every blocker below is concrete and fixable, in a clear order. This is a foundations problem, not a rewrite.
Findings
Sorted by pain. Each carries a severity and a confidence — and repeated noise is grouped: the 12 secret-looking strings in test files are one line, not 12 alarms.
| Severity | Confidence | Count | Finding | Action |
|---|---|---|---|---|
| Critical | High | 1 | .env committed to the repository |
Remove from repo & history (git filter-repo), revoke keys, add to .gitignore |
| Critical | High | 1 | Looks like a Stripe live key in .env |
Revoke the key now; move to a secret store, never a committed file |
| Critical | High | 1 | Looks like a Stripe live key in src/config.js |
Remove from code & history, revoke, read it from env/Vault |
| Info | Medium | 12 | Possible test-fixture secrets — 12 files (GitHub-token shaped), e.g. tests/api_1.test.js |
Mark as fakes (fake/test) or allowlist them; revoke any that are live |
| Important | High | 1 | No CI (GitHub Actions) — nothing checks the project even builds | Add a minimal workflow: install deps + run tests on push/PR |
| Important | High | 1 | README is skeletal (under 300 characters) | Add a run section and one line on who it is for |
| Important | High | 1 | No .gitignore |
Add entries: .env, node_modules/, dist/, *.log |
| Info | High | 1 | No deployment signal (Docker/Procfile/platform config) | Add a Dockerfile or describe deployment in the README |
| Info | High | 1 | No LICENSE — the legal status of the code is unclear |
Add a licence (commercial or OSS) before anyone sees this |
Repair estimate
5 × critical · 3 × important · 1 × info.Next steps — in order of pain
- Revoke the live keys, then remove
.envand the hard-coded secret from code and history. - Add a
.gitignore(with.env) and an.env.exampleso secrets stay out for good. - Add a minimal CI workflow and turn the test fixtures into clearly-marked dummies.
- Flesh out the README and add a
Dockerfile+LICENSE→ ready to hand off.
Anonymized sample. Layer 1 is fully offline — your code never leaves your machine; the audit reads structure and patterns locally and never shows a secret's value. The same audit runs in your terminal, your CI, your editor (VS Code / Cursor) and via MCP.