TRUEMEND · SAMPLE AUDIT REPORT · halyard-api · 2026-07-06phone version → · back to the report page
PAGE 01 · COVER
Truemend
Technical Audit Report
LIVE ANALYSIS · VENDORS.TS
1 // anti-pattern: try/catch-rethrow
2 async function saveVendor(data) {
3 try {
4 const res = await api(data);
5 return res;
6 } catch (e) {
7 throw e; // ← flagged
8 }
9 }
→ safe fix applied
async function saveVendor(data) {
const res = await api(data);
return res;
}
HEALTH SCORE · 47 FILES
6.6/ 10
Architecture7.3
Reliability5.4
Concurrency6.2
Errors4.9
Types6.9
Testing4.4
Code Quality Audit

halyard-api

Prepared for Halyard Systems
2026-07-06 · confidential
OVERALL HEALTH SCORE
6.6/ 10

Above the ship threshold, dragged down by two areas: testing and error handling. Nearly half of the 30 findings apply for free.

47
FILES ANALYZED
512
FUNCTIONS SCORED
47%
OF FIXES COST $0
PAGE 02 · EXECUTIVE SUMMARY
TRUEMEND · HALYARD-APIConfidential
Executive Summary
6.6/ 10
OVERALL HEALTH

A solid core with a thin safety net. Architecture and typing are strong; testing (4.4) and error handling (4.9) are the drag on the score.

47 FILES
512 FUNCTIONS
41% AI-AUTHORED
214 FINDINGS
FINDINGS BY SEVERITY · 214 TOTAL · AUTHORITATIVE COUNTS
9
Critical · 4%
38
High · 18%
102
Medium · 48%
65
Low · 30%
FIX ECONOMICS · WHAT IT COSTS TO CLEAR≈ $4,850 est. remediation · 47% costs $0
1017241
Patches

$0 · applied for you, file still compiles

Refactors

≈ $2,400 · reviewed, bounded scope

Rewrites

≈ $2,450 · a human decides

WEAKEST DIMENSIONS · BOTTOM 5 OF 40 · LOOK HERE FIRST
Test strategy3.8
Logic clarity4.2
Test quality4.4
Error transparency4.5
Timeout discipline4.6
© 2025 Truemend™2
PAGE 03 · SCORECARD · CLUSTERED
TRUEMEND · HALYARD-APIConfidential
40-Dimension Scorecard

Seven families, forty signals

The forty dimensions rolled into named families so the shape reads at a glance. Full per-dimension detail follows overleaf.

Architecture
8 dims
7.3
▼ Abstraction fitness 6.5▲ Package organization 8.2
Reliability
6 dims
5.4
▼ Timeout discipline 4.6▲ Memory pressure 6.2
Concurrency & Data
4 dims
6.2
▼ Transaction boundary 5.6▲ Serialization fidelity 6.8
Errors & Observability
3 dims
4.9
▼ Error transparency 4.5▲ Error consistency 5.2
Types & Contracts
5 dims
6.9
▼ Boundary validation 6.0▲ Type safety 8.5
Testing
3 dims
4.4
▼ Test strategy 3.8▲ Assertion density 4.9
Hygiene & Debt
11 dims
6.5
▼ Logic clarity 4.2▲ Import health 7.8
WEIGHTED OVERALL
6.6/ 10

Testing and Errors & Observability pull hardest against the score.

© 2025 Truemend™3
PAGE 04 · SCORECARD · FULL DETAIL
TRUEMEND · HALYARD-APIConfidential
All 40 Dimensions · Sorted Worst-First
Test strategy3.8
Logic clarity4.2
Test quality4.4
Error transparency4.5
Timeout discipline4.6
Assertion density4.9
Null safety5.0
Logging quality5.0
Graceful degradation5.1
Error consistency5.2
Runtime resilience5.5
Transaction boundary5.6
Resource lifecycle5.8
AI-generated debt5.9
Thread safety6.0
Boundary validation6.0
Authorization consistency6.0
Dead-code risk6.1
Memory pressure6.2
Config consistency6.4
API contract drift6.4
Abstraction fitness6.5
Dependency fragility6.5
API surface coherence6.6
Incomplete migration6.6
Feature completeness6.7
Low-level elegance6.8
Serialization fidelity6.8
Convention drift6.8
Initialization coupling6.9
Design coherence7.0
Contract coherence7.0
Mid-level elegance7.2
Dependency health7.2
Naming quality7.4
High-level elegance7.6
Import health7.8
Cross-module architecture8.0
Package organization8.2
Type safety8.5
OVERALL HEALTH6.6/ 10
© 2025 Truemend™4
PAGE 05 · FINDINGS · GROUPED BY FIX COST
TRUEMEND · HALYARD-APIConfidential
Findings · top 30 of 214
▲Showing the top 30 of 214 findings, ranked by severity. Headline counts above use full totals; the complete list ships in the JSON export.
Patches · $014Applied for you · file still compiles · undone on failure
HighRedundant try/catch rethrow
saveVendor · src/api/vendors.ts : 42–50
52→78+26

Catch block only rethrows: it swallows nothing and adds nothing. Remove it; the error already propagates.

Mediumconsole.log in a hot request path
processOrder · src/orders/pipeline.ts : 118
66→78+12

Debug logging left in a production path. Strip the statement, no behavioural change.

Refactors · reviewed10Known change · reviewed before it lands · bounded scope
HighSame validation guard copy-pasted ×7
handlers · src/api/*.ts (7 sites)
58→76+18

An 11-line guard duplicated across seven handlers. Extract to one helper under a constrained prompt.

Rewrites · a human decides6Too big to apply automatically · evidence attached
CriticalUnbounded context load
buildPrompt · src/llm/context.ts : 64
34→71+37

Loads the entire repo into a single prompt: memory and cost blow up on large trees. Needs an architectural chunking decision.

© 2025 Truemend™ · findings 1–4 of 214 · ranked by severity5
PAGE 06 · COMPLIANCE & GOVERNANCE
TRUEMEND · HALYARD-APIConfidential
Compliance & Governance · 9 frameworks · evidence-mapped

Findings, cited against real controls

Every audit maps its findings to nine frameworks. Control IDs are genuine citations: a violated control lists the actual finding as evidence. A clean row means verified clean, not unexamined.

SOC 2
4 of 61 controls hit
93%
✗ CC6.1: logical access controls
Authorization consistency (3 findings)
ISO/IEC 27001
5 of 93 controls hit
95%
✗ A.8.28: secure coding
Boundary validation (2 findings)
OWASP Top 10
3 of 10 controls hit
70%
✗ A03:2021: injection
Boundary validation at API surface
HIPAA
0 of 42 controls hit
100%
✓ verified clean
PCI-DSS
2 of 78 controls hit
97%
✗ 6.2.4: software attack prevention
Broad except swallows errors
GDPR
1 of 32 controls hit
97%
✗ Art.32: security of processing
Model output missing PII filter
EU AI ActAI
2 of 12 controls hit
83%
✗ Art.15: accuracy, robustness, cybersecurity
PII filter + unbounded context load
NIST AI RMFAI
2 of 19 controls hit
89%
✗ MS-2: systems evaluated for trustworthiness
PII filter + unbounded context load
ISO/IEC 42001AI
1 of 24 controls hit
96%
✗ A.6.2.4: verification & validation
Model output missing PII filter
The three AI-governance frameworks (EU AI Act, NIST AI RMF, ISO/IEC 42001) appear in every report: a codebase with no AI-relevant findings shows them verified clean. Full per-control detail for the worst-scoring framework follows overleaf.
© 2025 Truemend™6
PAGE 07 · EU AI ACT · CONTROL DETAIL
TRUEMEND · HALYARD-APIConfidential
Framework Detail · EU AI Act

EU AI Act: Regulation (EU) 2024/1689

83%
2 OF 12 MAPPED ARTICLES HIT
Art.9Risk management system✓ verified clean
Art.10Data & data governance✓ verified clean
Art.12Record-keeping✓ verified clean
Art.13Transparency & provision of information✓ verified clean
Art.14Human oversight✓ verified clean
Art.15Accuracy, robustness & cybersecurity✗ 2 findings cited
CriticalModel output returned with no PII filtersrc/api/handler.py : 142
CriticalUnbounded context loadsrc/llm/context.ts : 64
Both Art.15 citations are structural findings: they appear in the findings section with full what/why/fix detail, cross-referenced here by page. One layout serves all 9 frameworks; the worst-scoring framework gets this page, others available on request.
© 2025 Truemend™7
PAGE 08 · METHODOLOGY & CLOSE
TRUEMEND · HALYARD-APIConfidential
Methodology & Validation

How this report is made

01
Local analysis, not guesswork

Every score comes from analysis running on your machine, no model in the detection loop. Forty quality dimensions are each scored 0–10 by mechanical validators (coupling, padding, type-safety, test-ratio and semantic detectors), then weighted into the overall.

02
Every finding carries its fix cost

Each issue is classified into one of three tiers, so you always know what clearing it takes.

Patches

Mechanical fix. The file still compiles, or the change is undone.

Refactors

Known change, reviewed before it lands. Bounded scope.

Rewrites

Too big to apply automatically. Flagged for a person.

03
Fixes are proven before they count

Safe fixes are validated by re-parse + lint: the changed source must still compile or the original is restored. Score deltas are measured, not estimated. Your code never leaves the machine.

Point it at your repo.
Watch it come true.
$ npx truemend init →
truemend.ai
hello@truemend.ai
code, made true