HALYARD-API · 2026-07-066.6 / 10

Code quality audit

halyard-api
health 6.6

6.6/ 10

Above the ship threshold, dragged down by testing and error handling. Nearly half of the 214 findings apply for free.

FILES ANALYZED

512

FUNCTIONS SCORED

47%

OF FIXES COST $0

41%

AI-AUTHORED

The fix on the cover · vendors.ts

FLAGGED

1 // anti-pattern: try/catch-rethrow

2 async function saveVendor(data) {

3 try {

4 const res = await api(data);

5 return res;

6 } catch (e) {

7 throw e; // ← flagged

8 }

9 }

verified by ast-grep re-parse · reversible · $0

Findings by severity · 214 total

● 9 critical · 4%● 38 high · 18%● 102 medium · 48%● 65 low · 30%

Findings · filter by fix cost

HIGH+26

Redundant try/catch rethrow

saveVendor · src/api/vendors.ts : 42–50

Catch block only rethrows: it swallows nothing and adds nothing. Remove it; the error already propagates.

MEDIUM+12

console.log in a hot request path

processOrder · src/orders/pipeline.ts : 118

Debug logging left in a production path. Strip the statement, no behavioural change.

MEDIUM+9

Unused exports bloat the barrel

index · src/utils/index.ts : 1–14

Nine exported symbols with zero importers. Delete them; imports re-resolve cleanly.

LOW+8

var → const

legacyAdapter · src/adapters/legacy.js : 30

Reassignment never happens. Mechanical AST transform, guaranteed correct.

HIGH+18

Same validation guard copy-pasted ×7

handlers · src/api/*.ts (7 sites)

An 11-line guard duplicated across seven handlers. Extract to one helper under a constrained prompt.

MEDIUM+16

Broad except swallows errors

ingest · src/ingest/run.py : 88

A bare except hides the failure mode. Narrow to the real exception type and log context.

CRITICAL+37

Unbounded context load

buildPrompt · src/llm/context.ts : 64

Loads the entire repo into a single prompt: memory and cost blow up on large trees. Needs an architectural chunking decision.

CRITICAL+44

Model output returned without PII filter

handler · src/api/handler.py : 142

LLM output reaches the client with no guardrail. Requires a human call on the filtering policy.

showing the top 30 of 214 by severity · full list in the JSON export

Scorecard · tap a family

Test strategy3.8

Test quality4.4

Assertion density4.9

Fix economics · ≈ $4,850 est.

Deterministic101 · 47%

$0 · applies automatically, verified re-parse

Cataloged refactor72 · 34%

≈ $2,400 · constrained LLM, validated

Structural rewrite41 · 19%

≈ $2,450 · human decision required

Compliance · 9 frameworks

SOC 2✗ CC6.1: logical access controls93%

ISO/IEC 27001✗ A.8.28: secure coding95%

OWASP Top 10✗ A03:2021: injection70%

HIPAA✓ verified clean100%

PCI-DSS✗ 6.2.4: software attack prevention97%

GDPR✗ Art.32: security of processing97%

EU AI ActAI✗ Art.15: accuracy, robustness, cybersecurity83%

NIST AI RMFAI✗ MS-2: systems evaluated for trustworthiness89%

ISO/IEC 42001AI✗ A.6.2.4: verification & validation96%

Point it at your repo.
Watch it come true.

See pricing →

print version →

halyard-apihealth 6.6

halyard-api
health 6.6