Truemend™
Technical Audit Report
Grove / Grove

Your codebase has issues. 9 of them cost nothing to fix.

78.1
Health score
/ 100

Truemend analyzed 5,550 files and 14,718 functions. 51,724 quality issues found; <1% can be fixed automatically at zero cost.

Analyzedthe whole repository
Illustration · before (not from this repository)
1// before: console.log + try/catch rethrow
2function PayButton({ amount }) {
3 console.log("pay", amount);
4 try {
5 return <button onClick={() => charge(amount)}>Pay</button>
6 } catch (err) {
7 throw err;
8 }
9}
Illustration · after, a $0 deterministic fix
1// after: deterministic, $0
2function PayButton({ amount }: { amount: number }) {
3 return <button onClick={() => charge(amount)}>Pay</button>
4}
Score details · 5,550 files
Logic Clarity
95
Error Handling
98
Type Safety
61
Test Strategy
80
Naming Quality
100
10/26/2026
truemend.ai
Truemend™

Contents

What this report contains

Jump to a section, or print the whole document.

DET Deterministic: automatic, $0CAT Cataloged: guided refactorSTR Structural: human decision

Health Score on the cover is the mechanical composite /100. Subjective quality lives on its own page when a review ran.

Truemend™

Executive Overview

Code Quality Assessment: Grove

Truemend performed an automated code quality audit of 5,550 source files containing 14,718 functions across 947,595 lines of code. This report summarizes the findings and quantifies the engineering effort required to address them.

Issue severity

High4%Medium19%Low2%Info74%51724issues

Fix type

Cataloged91%Structural9%0%fixable for $0
Open issues, 90 days
Unchanged
Stable. 51724 open at the start of the window, 51724 today.
Cleared from day 1
0
Issues Truemend has applied.
Hours this audit saves
2453
86% of the manual estimate
Truemend™

Industry Benchmark

This project versus the industry

The health score on the cover is mechanical. These marks show where that score sits relative to published industry averages, not a second scoring system.

Health score vs industry

+16 vs average
78.1
Industry avg: 62
Top quartile: 78
Project: 78.1
Above average: top quartile
Pattern density
54.6 / 1k LOC
+42.1 vs industry avg (12.5)
Codebase size
947,595 LOC
5,550 files, 14,718 functions
Truemend™

Financial Impact

Cost of Inaction vs Remediation

Technical debt compounds. Industry research shows unaddressed code quality issues grow at approximately 23% annually as surrounding code adapts to work around problems, making them progressively harder to resolve.

Current remediation
$674,227
At blended rate of $150/hr
In 6 months
$751,763
+$77,536 if you wait
In 12 months
$829,299
+$155,072 if you wait

Remediation cost trajectory

Fix Now
674,227
In 6 Months
751,763
In 12 Months
829,299
Truemend™

Remediation Effort

Engineering time and fix mix

Manual remediation is priced at the full effort. Truemend keeps only the hours that still need a person: cataloged procedures and structural rewrites.

Engineering time: manual vs Truemend

Manual
2,847
With Truemend
393
Manual effort
71.2 weeks
2847 engineering hours
With Truemend
9.8 weeks
393 engineering hours

Remediation by fix type

Deterministic
9
Cataloged
46,430
Structural
4,663

9 deterministic fixes. Automated AST transforms applied instantly at zero cost.

46,430 cataloged refactors. Constrained procedures: 5 minutes each vs 90 minutes manually.

4,663 structural rewrites. These require human architectural judgment and stay flagged for review.

Truemend™

Return on Investment

Truemend ROI Analysis

The following breakdown compares the engineering cost of manual remediation against Truemend-assisted remediation for each fix category. Waiting does not freeze the bill: the same debt costs more as surrounding code adapts around it.

Cost if you wait

674,227
Fix now
751,763
Wait 6 months
829,299
Wait 12 months

Fixing now costs $674,227. Waiting 12 months raises that to $829,299 (+$155,072) before Truemend has still not run.

What waiting adds

Pay now81%If you wait19%$155,072extra in 12 mo
Fix TypeCountManual (per fix)Truemend (per fix)Manual TotalTruemend TotalSavings
Deterministic90 min0 min0 hrs0 hrs0 hrs
Cataloged Refactor46,4303 min0 min2598 hrs144 hrs2453 hrs
Structural Rewrite4,6633 min3 min249 hrs249 hrs0 hrs
Total51,1022847 hrs393 hrs2453 hrs

Cover issue count (51,724) includes findings not classified into a fix tier. This table totals 51,102.

$585,764
Estimated Cost Savings
Manual: $674,227 → Truemend: $88,463
2453
Engineering Hours Saved
71.2 weeks → 9.8 weeks
0%
Issues Auto-Fixed
9 instant, zero-cost fixes
Bottom Line: Truemend reduces remediation time from 71.2 developer-weeks to 9.8 weeks, a 86% reduction. The 9 deterministic fixes apply automatically at zero cost and zero risk. Deferring action increases the total cost by $155,072 within 12 months.
Truemend™

Methodology

Assessment methodology

Every Truemend audit follows a standardized, reproducible process. Findings are generated by deterministic AST analysis, regex line-scan, and semantic Python analysis, not opinion.

Analysis Engine

Detection

4,672 anti-patterns across 149 spec files using ast-grep (Rust AST), regex line-scan, and semantic Python analysis. 26 language grammars.

Scoring

Mechanical health score (0-100) computed from anti-pattern density, severity weights, and function-level metrics. Optional LLM-powered subjective review across 40 dimensions with blind review mode.

Classification

Three-tier fix classification ensures every finding has a clear, cost-appropriate remediation path.

Structural Analysis

8 project-level detectors: naming consistency, flat directories, orphaned files, dead code blocks, single-use abstractions, signature variance, passthrough files, duplicate clusters.

Production Readiness

13-check assessment with PASS/FAIL/WARN verdicts and blocker identification.

Team Quality

Per-author attribution from git history: commits, debt introduced/fixed, test discipline, commit message quality.

Cost Model

Each finding priced from its pattern fix-time estimate at the audit rate and overhead shown under Financial Impact, calibrated with measured fix times.

Quality Dimensions

Readability (0-100)
How easy the code is to read and follow.
Simplicity (0-100)
Whether the code avoids unnecessary complexity.
Design Coherence (0-100)
How well components fit together.
Convention Adherence (0-100)
Consistency with project conventions.
Error Handling (0-100)
Robustness of error detection and recovery.
Naming Quality (0-100)
Clarity and descriptiveness of identifiers.
Type Safety (0-100)
Strength and correctness of type annotations.
API Surface (0-100)
Clarity and minimality of public interfaces.
Test Strategy (0-100)
Coverage, isolation, and quality of tests.
Abstraction Fitness (0-100)
Whether abstractions match the domain.
Logic Clarity (0-100)
How straightforward the control flow is.
Security (0-100)
Resistance to common vulnerability patterns.
40 mechanical + subjective dimensions available. Subjective dimensions scored via LLM review handoff (prepare → score → ingest).

Fix Classification

deterministicAutomatic AST transforms applied without human input. Free: no LLM cost.
cataloged refactorA known refactoring procedure with bounded scope and predictable cost.
structural rewriteA design-level decision that requires discussion before implementation.
Confidentiality Notice

This report was prepared exclusively for Grove in connection with the Grove engagement. It contains proprietary analysis and recommendations. Distribution, reproduction, or disclosure to third parties without written authorization is prohibited.

© 2026 Truemend™. All rights reserved.
Truemend™

Security Assessment

Security Posture

Security posture aggregates findings from anti-pattern detection, semantic boundary analysis, configuration scanning, and subjective dimension scoring. Findings include hardcoded secrets, XSS vectors, CSRF vulnerabilities, unvalidated input, and authorization gaps.

37
FAIL
Security Score
1421
Total Security Findings
262 critical
737 high
193 medium
47 low
182 info
Recommendation: Immediate action required — critical security vulnerabilities detected.
CRITICALsemantic-sql-injection-riskSQL query built with string interpolation — SQL injection risk.114
file-1734.py  file-2035.py  file-2196.py  file-2254.py  file-2395.py  file-2400.py  file-2411.py  file-2413.py +20 more
CRITICALsemantic-python-sql-injection-string-concatSQL query built with string concatenation or f-string — SQL injec20
file-1734.py  file-2035.py  file-2196.py  file-2254.py  file-2395.py  file-2400.py  file-2411.py  file-2415.py +6 more
CRITICALpython-sql-string-formatSQL query built with string formatting — SQL injection risk. Use 26
file-2413.py  file-3092.py  file-3094.py  file-3095.py
CRITICALsemantic-python-hardcoded-secretPotential hardcoded secret in variable 'TOKEN'1
file-3813.py
CRITICALtypescript-hardcoded-credsCredential literal assigned in source1
file-3761.ts
CRITICALsql-injection-riskSQL query built with string interpolation — SQL injection risk.114
file-1734.py  file-2035.py  file-2196.py  file-2254.py  file-2395.py  file-2400.py  file-2411.py  file-2413.py +20 more
HIGHsupabase_getsession_for_authgetSession() used for auth verification instead of getUser() — ge33
file-1135.tsx  file-1404.tsx  file-1717.ts  file-1757.ts  file-1788.ts  file-1905.ts  file-2113.tsx  file-2308.ts +19 more
continued on next page...
Truemend™

Security Assessment

Security Findings (continued 8–17 of 33 patterns)

HIGHpg_definer_no_searchpathSECURITY DEFINER without SET search_path660
file-003.sql  file-004.sql  file-005.sql  file-015.sql  file-028.sql  file-030.sql  file-043.sql  file-044.sql +264 more
HIGHpython-hardcoded-secretHard-coded secret, password, or API key in source code — use envi1
file-3813.py
HIGHbash-hardcoded-passwordPassword or secret string literal embedded directly in script sou2
file-2566.sh  file-2943.sh
HIGHsql_concat_in_whereConcatenation in WHERE clause17
file-023.sql  file-096.sql  file-532.sql  file-547.sql  file-568.sql  file-583.sql  file-593.sql  file-597.sql +2 more
HIGHhttp-exception-stack-in-responseHTTP response body includes an exception stack property (CWE-209)1
file-2129.ts
HIGHsql_in_clause_concatIN clause built by concatenation2
file-219.sql  file-532.sql
HIGHpg_grant_too_broadGRANT ALL on schema — excessive privileges16
file-315.sql  file-386.sql  file-407.sql  file-408.sql  file-410.sql  file-448.sql  file-492.sql  file-2978.sql
HIGHpg_hba_trustpg_hba.conf using trust authentication11
file-329.sql  file-426.sql  file-436.sql  file-442.sql  file-525.sql  file-581.sql  file-582.sql  file-591.sql +2 more
HIGHpg_dynamic_sql_injectDynamic SQL with unvalidated input2
file-3211.sql
MEDIUMsupabase_hardcoded_urlHardcoded Supabase project URL in source code — should use enviro15
file-737.test.tsx  file-1016.test.tsx  file-1784.test.ts  file-1785.test.ts  file-2220.test.tsx  file-2222.test.ts  file-2430.js  file-3032.test.ts
continued on next page...
Truemend™

Security Assessment

Security Findings (continued 18–27 of 33 patterns)

MEDIUMtoken_in_logsAuth token, JWT, or password logged to console or logger — creden19
file-1660.ts  file-1788.ts  file-1806.ts  file-2303.mjs  file-2336.ts  index.ts  file-2704.mjs  file-2753.ts +5 more
MEDIUMbash-signal-handler-trapTrap handlers doing too much cause re-entry issues2
file-1764.sh  file-1903.sh
MEDIUMsql_date_arithmeticString concatenation for date arithmetic — use DATEADD/INTERVAL12
file-427.sql  file-457.sql  file-520.sql  file-563.sql  file-605.sql  file-608.sql  file-631.sql  file-632.sql +1 more
MEDIUMsemantic-assert-in-productionassert statement used in production code (disabled with -O flag).103
file-1720.py  file-1722.py  file-1721.py  file-1723.py  file-1724.py  file-1725.py  file-3205.py  file-3206.py +6 more
MEDIUMtypescript-hardcoded-ipIP address literal written into the source3
index.ts
MEDIUMpg_public_schemaDefault public schema accessible to all47
file-015.sql  file-108.sql  file-147.sql  file-159.sql  file-175.sql  file-183.sql  file-215.sql  file-216.sql +31 more
MEDIUMsql_no_parameterizedString concatenation in SQL queries1
file-406.sql
MEDIUMsql_order_by_concatORDER BY with concatenated column5
file-538.sql  file-547.sql  file-553.sql  file-565.sql  file-636.sql
MEDIUMenviron-no-defaultos.environ["X"] raises KeyError if the variable is missing.2
file-3206.py  file-3207.py
LOWcross_test_imports_secretsTest imports production secrets, API keys, or credentials — risk 7
file-1901.test.ts  file-2496.test.ts  file-2705.test.ts  file-3160.test.ts
continued on next page...
Truemend™

Security Assessment

Security Findings (continued 28–33 of 33 patterns)

LOWsupabase_from_template_injection.from() table name built with template literal interpolation — en1
file-3785.test.ts
LOWdrizzle_hardcoded_connection_stringHardcoded database connection URL with embedded credentials — sec3
file-2561.test.mjs
INFOreact-onload-attributeInline event handler string instead of React event prop — XSS ris5
file-1217.test.tsx  file-1261.test.tsx  file-1305.test.tsx
INFOsemantic-ts-dangerously-set-innerhtmldangerouslySetInnerHTML used — XSS risk if content is untrusted138
file-639.jsx  file-640.jsx  file-1950.jsx  file-2017.jsx  file-2098.jsx  file-2542.jsx  file-3082.jsx  file-3117.jsx +2 more
INFOai-ux-unsanitized-streamed-htmlStreamed AI response content rendered via dangerouslySetInnerHTML36
file-3040.jsx
INFOxlang-cors-wildcardCORS allows all origins — credential theft risk1
file-3072.py
Truemend™

Production Readiness

Production Readiness Verdict

Assesses whether the codebase is ready for production deployment across 13 checks spanning security, testing, code quality, and structural health.

NOT READY
Verdict
5
Blockers
6
Warnings
2
Passing
462h
$103,950
Est. Remediation
StatusCheckDetailsBlocker
FAILCritical findings148 critical-severity anti-patterns detected (fail at 1)Yes
FAILHigh-severity findings2053 high-severity findings (warn at 1, fail above 10)Yes
FAILTest coverage0 test files — no test coverage (fail at 0 files, warn below 50%)Yes
FAILSecurity issues262 critical, 737 high security findings (fail at 1)Yes
FAILHardcoded secrets32 hardcoded secrets detected (fail at 1)Yes
WARNHealth scoreHealth score 78.1 (fail below 60, warn below 80)No
WARNOrphaned files747 orphaned files (123,313 lines), 13.5% of files (warn above 5%)No
WARNDead code blocks1563 dead code blocks (14,044 lines), 1.65/KLOC (warn above 1.5/KLOC)No
WARNDuplicate clusters4169 duplicate clusters (14518 copies), 25.2% of lines duplicated (warn above 10%)No
WARNFunction length violations670 functions over 50 lines (warn above 50 such functions)No
WARNDebug artifacts1876 debug print statements (warn at 1)No
PASSEmpty catch blocksNo empty catch blocks (warn at 1, fail above 5)Yes
PASSUnused imports30 unused imports, 0.03/KLOC (warn above 0.1/KLOC)No
Truemend™

Dead Exports

308 Unused Exports Detected

Dead exports are symbols (functions, classes, constants) that are defined and exported but never imported or called within the codebase. Removing them reduces bundle size, decreases cognitive load, and eliminates potential attack surface.

FileSymbolLineSeverityDescription
file-3072.pyHandler9MEDIUMPublic symbol 'Handler' is defined but never imported by any other file in the project
file-1920.pysentences81MEDIUMPublic symbol 'sentences' is defined but never imported by any other file in the project
file-1920.pycanon_hits85MEDIUMPublic symbol 'canon_hits' is defined but never imported by any other file in the project
file-1920.pyclassify108MEDIUMPublic symbol 'classify' is defined but never imported by any other file in the project
file-1900.pysay63MEDIUMPublic symbol 'say' is defined but never imported by any other file in the project
file-1900.pysection67MEDIUMPublic symbol 'section' is defined but never imported by any other file in the project
file-1900.pyfind_tsx_files75MEDIUMPublic symbol 'find_tsx_files' is defined but never imported by any other file in the project
file-1900.pyis_violation91MEDIUMPublic symbol 'is_violation' is defined but never imported by any other file in the project
file-1900.pycheck_safe_area_imports104MEDIUMPublic symbol 'check_safe_area_imports' is defined but never imported by any other file in the project
file-1989.pyluminance17MEDIUMPublic symbol 'luminance' is defined but never imported by any other file in the project
file-1989.pycontrast23MEDIUMPublic symbol 'contrast' is defined but never imported by any other file in the project
file-1989.pyPair29MEDIUMPublic symbol 'Pair' is defined but never imported by any other file in the project
file-1989.pygrade199MEDIUMPublic symbol 'grade' is defined but never imported by any other file in the project
file-1989.pyreport208MEDIUMPublic symbol 'report' is defined but never imported by any other file in the project
file-1714.pyparse_allow125MEDIUMPublic symbol 'parse_allow' is defined but never imported by any other file in the project
file-2093.pyimpersonate28MEDIUMPublic symbol 'impersonate' is defined but never imported by any other file in the project
file-2093.pyinsert_new_key36MEDIUMPublic symbol 'insert_new_key' is defined but never imported by any other file in the project
file-2093.pypick_stranded_and_other54MEDIUMPublic symbol 'pick_stranded_and_other' is defined but never imported by any other file in the project
file-2232.pyenv_value65MEDIUMPublic symbol 'env_value' is defined but never imported by any other file in the project
file-2232.pynew_media_path83MEDIUMPublic symbol 'new_media_path' is defined but never imported by any other file in the project
file-2232.pymove_storage_object89MEDIUMPublic symbol 'move_storage_object' is defined but never imported by any other file in the project
file-2232.pyfix_media_paths107MEDIUMPublic symbol 'fix_media_paths' is defined but never imported by any other file in the project
file-2232.pyfix_observation_hours151MEDIUMPublic symbol 'fix_observation_hours' is defined but never imported by any other file in the project
file-2246.pyquery28MEDIUMPublic symbol 'query' is defined but never imported by any other file in the project
file-2364.pyas_user34MEDIUMPublic symbol 'as_user' is defined but never imported by any other file in the project
file-2364.pyexpect_error42MEDIUMPublic symbol 'expect_error' is defined but never imported by any other file in the project
file-2392.pytry_insert21MEDIUMPublic symbol 'try_insert' is defined but never imported by any other file in the project
file-2393.pyimpersonate27MEDIUMPublic symbol 'impersonate' is defined but never imported by any other file in the project
file-2393.pystop_impersonating35MEDIUMPublic symbol 'stop_impersonating' is defined but never imported by any other file in the project
file-2393.pyattempt39MEDIUMPublic symbol 'attempt' is defined but never imported by any other file in the project
+ 278 additional dead exports
Truemend™

Test Health

Test Coverage Analysis

Truemend estimates test coverage by matching public function definitions against test file references (no coverage report was found; pass --coverage to measure it). Functions with higher cyclomatic complexity are prioritized as the highest-value test targets.

0%
Estimated Coverage
Industry avg: 42%
0
Functions with Tests
of 3,954 total
3,954
Untested Functions
highest-risk gaps below

Coverage vs Industry

Your Project
0
Industry Avg
42
Recommended
60

Highest-Priority Test Gaps

Ranked by cyclomatic complexity — complex untested functions carry the most risk.

FileFunctionComplexityLineSource
file-3210.pyrun6515inferred
file-3212.pyrun5411inferred
file-2056.pycheck_unreferenced_routes41209inferred
file-3240.pymain34412inferred
file-2056.pycheck_orphan_routes34332inferred
file-3093.pymain3377inferred
file-3240.pyapply29272inferred
file-1920.pyclassify27108inferred
file-2233.pytransform_file25175inferred
file-3094.pymain2235inferred
file-3240.pysplit_statements2074inferred
file-3215.pyrun1917inferred
file-3825.pymain1997inferred
file-2418.pymain1873inferred
file-3213.pyrun1724inferred
Showing the 15 highest-complexity public gaps of 3,954 untested functions (the complete list ships in the JSON export: truemend audit --format json, test_coverage.untested)
Truemend™

Migration Health

353 Stale Migration Findings

Stale migrations are signs of incomplete refactorings: mixed dir-336/file-2631 API usage, migration-related TODO comments, deprecated file naming, and dual dependencies in package configs. Each indicates work that was started but not finished, accumulating confusion and technical debt.

353
Total Migration Issues
163 medium
190 low
Pattern breakdown:
mixed-logging (190)mixed-async-patterns (152)deprecated-file-naming (9)mixed-react-components (2)
SeverityPatternDescriptionFiles
MEDIUMmixed-async-patternsMixed async patterns: both callbacks and async/await in the same codebase147
_layout.tsx file-2154.tsx file-2935.tsx file-1688.tsx file-2064.ts file-2998.ts file-1676.test.tsx file-2581.ts file-1019.test.tsx file-798.test.tsx file-1514.test.ts file-1226.test.tsx file-1163.test.tsx file-1341.test.tsx file-885.test.tsx file-1788.test.ts file-3325.test.ts file-3653.test.ts file-3754.test.ts file-3686.test.tsx+ 127 more
MEDIUMdeprecated-file-namingFile 'file-012.jsx' uses deprecated/backup naming convention, suggesting9
file-012.jsx file-3881.html file-010.jsx file-638.jsx file-008.jsx file-643.jsx file-3882.html file-3883.html file-640.jsx
MEDIUMmixed-react-componentsMixed React patterns: both class components and hooks detected2
file-2882.d.ts file-984.tsx
LOWmixed-loggingMixed logging: both print() and logging module used for output190
file-2073.py file-1989.py file-1900.py file-2055.py file-2056.py file-3781.py file-2482.py file-1764.sh file-2233.py file-3874.py file-2054.py file-3248.py file-1920.py file-2991.py file-3273.py file-3819.py file-2398.py file-3816.py file-3204.py file-2246.py+ 170 more
Truemend™

Structural Analysis

Structural Health

Structural analysis detects naming inconsistencies, flat directory sprawl, orphaned files, dead code, passthrough functions, and signature issues across the codebase. Scan completed in 34897ms.

3252
Total Structural Issues

By Category

Naming Issues
119
Flat Directories
57
Single-Use Modules
451
Orphaned Files
747
Signature Issues
264
Passthrough Functions
51
Dead Code
1563
CategoryFindingFile
Naming Issues2 files violate snake_case.
Naming Issues5 files violate snake_case./app
Naming Issues2 files violate kebab-case./app/.maestro
Flat Directories647 files (threshold: 20)./dir-298/file-2563
Flat Directories365 files (threshold: 20)./docs/file-3877
Flat Directories299 files (threshold: 20)./app/src/hooks
Single-Use ModulesOnly imported by app/file-3878app/jest.config.js
Single-Use ModulesOnly imported by app/metro.config.jsapp/file-2559.js
Single-Use ModulesOnly imported by app/scripts/dir-164/file-3879app/scripts/dir-164/file-1831.ts
Orphaned Fileszero importers, not an entry pointapp/app.config.ts
Orphaned Fileszero importers, not an entry pointapp/app/(auth)/_layout.tsx
Orphaned Fileszero importers, not an entry pointapp/app/(auth)/complete-profile.tsx
Truemend™

Duplicates

Duplicate Function Clusters

Duplicate detection identifies functions with identical or near-identical logic across multiple files. Consolidating duplicates reduces maintenance burden and prevents divergent bug fixes.

Duplicate Clusters
4169
Duplicate Functions
14518
FunctionCopiesSimilarityFound In
<block:34>721100%file-1769.test.tsx, file-3851.test.tsx, file-1931.test.tsx, file-2693.test.tsx +717
<block:11>266100%file-1660.test.ts, file-1660.test.ts, file-1660.test.ts, file-1772.test.ts +262
<block:109>179100%file-2082.ts, index.test.ts, index.test.ts, index.test.ts +175
<block:145>171100%file-1457.test.tsx, file-2696.ts, file-1569.tsx, file-1137.tsx +167
<block:347>105100%file-2769.tsx, file-2277.tsx, file-925.tsx, file-1041.tsx +101
<block:11>94100%file-2080.css, file-2080.css, file-2080.css, file-2080.css +90
<block:11>70100%file-009.jsx, file-010.jsx, file-011.jsx, file-012.jsx +66
<block:52>70100%file-2120.tsx, index.tsx, file-1798.ts, file-893.tsx +66
jsonResponse6895%file-1660.test.ts, file-1772.test.ts, file-2082.ts, file-2765.ts +64
<block:50>62100%file-2979.ts, file-3070.ts, file-2046.ts, index.ts +58
<block:13>62100%file-655.ts, file-694.ts, file-697.ts, file-730.ts +58
<block:68>55100%file-3292.test.ts, file-3292.test.ts, file-3292.test.ts, file-3292.test.ts +51
<block:22>54100%file-1712.py, file-1714.py, file-1734.py, file-2395.py +50
<block:19>53100%file-153.sql, file-257.sql, file-296.sql, file-306.sql +49
<block:33>46100%file-718.tsx, file-1171.tsx, file-1331.tsx, file-1413.tsx +42
+ 4154 more clusters (the largest 604 ship in the JSON export: truemend audit --format json)
Truemend™

Subjective Review

Subjective Quality Dimensions

These scores are 0-100 readings of style, naming, error handling, design, and test strategy. They complement anti-pattern counts: a file can be mechanically clean and still hard to change. The cover reports one mechanical health score; this page is the qualitative half.

89
Overall Score / 100 (over 39 of 40 dimensions)
Low Level Elegance
100
Naming Quality
100
Convention Drift
100
Ai Generated Debt
100
Abstraction Fitness
100
Thread Safety
100
Logging Quality
100
Api Contract Drift
100
Assertion Density
100
Dependency Fragility
100
Config Consistency
99
Runtime Resilience
99
Feature Completeness
99
Serialization Fidelity
99
Dead Code Risk
99
Null Safety
98
Test Quality
98
Error Consistency
98
Graceful Degradation
96
Logic Clarity
95
Incomplete Migration
95
Contract Coherence
95
Timeout Discipline
95
Memory Pressure
93
Cross Module Architecture
92
Import Health
91
High Level Elegance
89
Resource Lifecycle
88
Error Transparency
87
Boundary Validation
85
Test Strategy
80
Transaction Boundary
78
Initialization Coupling
70
Mid Level Elegance
65
Type Safety
61
Dependency Health
50
Package Organization
40
Authorization Consistency
40
Design Coherence
23

How the score is built

Clarity
98
How easily a reviewer can follow the code.
Logic Clarity 95: Whether control flow and branching say what they mean, or hide the real path.
Naming Quality 100: Names carry domain meaning instead of filler (`data`, `handleClick`, `utils`).
Safety
79
Whether failures and types are handled with intent.
Error Handling 98: Failures are handled with a policy, not swallowed, rethrown empty, or logged at random.
Type Safety 61: Types constrain call sites instead of leaking `any`, untyped props, or guesswork.
Structure
61
Whether the design matches the problem being solved.
Design 23: Module boundaries match the problem; related behavior lives together.
Abstraction 100: Helpers earn their keep. One-use wrappers and pass-throughs do not.
Verification
80
How well tests pin behavior that will change.
Test Strategy 80: Tests pin behavior at the seams that change, not only the happy path.

Needs attention

Design 23
Module boundaries match the problem; related behavior lives together.
Package Organization 40
Authorization Consistency 40

Holding up

Assertion Density 100
Api Contract Drift 100
Logging Quality 100
Truemend™

Finding History

51724 Detector Findings Tracked, 0 Reopened

Truemend records every analysis run in an append-only ledger. Findings below have been observed across multiple runs; a reopened finding was fixed at some point and returned. Rows are one per (file, line, pattern) below, the same granularity as the total anti-pattern count elsewhere in this report — a single reopened line can still contribute more than one row if more than one rule fires on it. “At least Nx” means a run of unknown scope makes the true count uncertain — never inflated, only ever a floor.

FileLinePatternRunsReopened
file-3884.yaml1yaml-missing-document-start4never
file-3885.yaml1yaml-missing-document-start4never
file-2516.yaml1yaml-missing-document-start4never
file-3886.yaml1yaml-missing-document-start4never
file-3081.yaml1yaml-missing-document-start4never
App.tsx4rn-loading-no-error-boundary4never
App.tsx16rn-dark-hardcoded-colors4never
App.tsx4rn-dark-no-appearance-hook4never
App.tsx4react-default-export-inconsistency4never
file-3827.js37typescript-biome-no-useless-this-alias4never
file-1825.js21react-context-default-value-mismatch4never
file-2239.js2high-complexity4never
file-2160.js6rn-responsive-hardcoded-dimensions4never
file-2175.js13react-ux-effect-missing-deps4never
file-2878.js62typescript-eslint-ts-prefer-optional-chain4never
file-2884.js11rn-responsive-hardcoded-dimensions4never
file-2876.js89rn-responsive-hardcoded-dimensions4never
file-2876.js52typescript-unicorn-no-array-reduce4never
file-1769.test.tsx29test_mock_everything4never
file-1769.test.tsx35test_mock_everything4never
file-1769.test.tsx39test_mock_everything4never
file-1769.test.tsx48test_mock_everything4never
file-1769.test.tsx64test_no_aftereach_cleanup4never
file-1769.test.tsx75test_no_aftereach_cleanup4never
file-1769.test.tsx83test_no_aftereach_cleanup4never
file-1769.test.tsx91test_no_aftereach_cleanup4never
file-2534.test.tsx26test_no_aftereach_cleanup4never
file-2535.test.tsx94react-missing-user-event-tests4never
file-2535.test.tsx9test_mock_everything4never
file-2535.test.tsx14test_mock_everything4never
+ 51694 additional tracked findings
Truemend™

Change Age

18265/51724 Findings Age-Resolved via Git Blame

Each finding's enclosing function is matched against git blame to determine when it last changed. “Unknown” means git blame could not resolve an age (no repo, uncommitted file, or unresolvable range) -- it is never a false claim of freshness.

FileLinePatternChanged Since
file-3884.yaml1yaml-missing-document-start2026-06-10T01:40:23+00:00
file-3885.yaml1yaml-missing-document-start2026-04-15T18:35:45+00:00
file-2516.yaml1yaml-missing-document-start2026-04-15T18:35:45+00:00
file-3886.yaml1yaml-missing-document-start2026-06-10T11:39:09+00:00
file-3081.yaml1yaml-missing-document-start2026-04-15T18:35:45+00:00
App.tsx4rn-loading-no-error-boundaryunknown
App.tsx16rn-dark-hardcoded-colorsunknown
App.tsx4rn-dark-no-appearance-hookunknown
App.tsx4react-default-export-inconsistencyunknown
file-3827.js37typescript-biome-no-useless-this-aliasunknown
file-1825.js21react-context-default-value-mismatchunknown
file-2239.js2high-complexity2026-05-06T19:26:55+00:00
file-2160.js6rn-responsive-hardcoded-dimensionsunknown
file-2175.js13react-ux-effect-missing-depsunknown
file-2878.js62typescript-eslint-ts-prefer-optional-chainunknown
file-2884.js11rn-responsive-hardcoded-dimensionsunknown
file-2876.js89rn-responsive-hardcoded-dimensionsunknown
file-2876.js52typescript-unicorn-no-array-reduceunknown
file-1769.test.tsx29test_mock_everythingunknown
file-1769.test.tsx35test_mock_everythingunknown
file-1769.test.tsx39test_mock_everythingunknown
file-1769.test.tsx48test_mock_everythingunknown
file-1769.test.tsx64test_no_aftereach_cleanupunknown
file-1769.test.tsx75test_no_aftereach_cleanupunknown
file-1769.test.tsx83test_no_aftereach_cleanupunknown
file-1769.test.tsx91test_no_aftereach_cleanupunknown
file-2534.test.tsx26test_no_aftereach_cleanupunknown
file-2535.test.tsx94react-missing-user-event-testsunknown
file-2535.test.tsx9test_mock_everythingunknown
file-2535.test.tsx14test_mock_everythingunknown
+ 51694 additional findings
Truemend™

Executive Summary

51,724 anti-patterns in 4125 of 5,550 files analyzed, 9 fixable at zero cost.

Truemend analyzed 5,550 source files containing 14,718 functions. <1% of findings (9) are deterministic fixes the engine applies automatically, each verified by a re-parse.

5550
Files analyzed
14718
Functions analyzed
51724
Anti-patterns found
9
Deterministic fixes

Severity Distribution

Critical · 148
High · 2053
Medium · 9957
Low · 1236
Info · 38330

Fix Type Distribution

9
Deterministic: automatic, zero-cost AST transforms
46430
Cataloged refactor: constrained LLM-guided fixes
4663
Structural rewrite: flagged for human decision
<1%
of issues fixable at $0 cost. 9 deterministic fixes, zero risk.

Worst Files by Anti-Pattern Density

1
file-639.jsx
487 findings
2
file-640.jsx
487 findings
3
file-371.sql
408 findings
4
file-375.sql
375 findings
5
file-352.sql
323 findings
6
file-374.sql
309 findings
7
file-3040.jsx
284 findings
8
file-3040.jsx
284 findings
9
file-3040.jsx
284 findings
10
file-3040.jsx
284 findings
Truemend™

Detailed Findings

51,724 anti-patterns in 4125 of 5,550 files analyzed

Each row is one pattern in one file, collapsed across functions. Open Finding Details for evidence, recommended fix, and the files this finding can reach.

By severity

High4%Medium19%Low2%Info74%51724total

By fix type

Cataloged91%Structural9%9free fixes
docs/dir-101/dir-55/dir-20/file-639.jsx
Health: 51.5  ·  1268 lines
FindingCtSeverityFixLines
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
315INFOSTR49–1214
Inline style object literal creates new reference every render
react-inline-style-object
86INFOCAT67–1216
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
16INFOCAT48–934
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
16INFOCAT49–935
label element must have associated input control
react-a11y-label-has-assoc
12INFOCAT164–946
Form input using defaultValue instead of value + onChange - form data cannot be validated or controlled programmatically
react-uncontrolled-input
10INFOCAT165–947
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
10INFOCAT421–1062
Input without associated label — inaccessible to screen readers and autofill
react-input-no-label
4INFOCAT165, 169, 175, 219
Form input without associated label — screen readers cannot identify purpose
react-ux-form-no-label
4INFOCAT165, 169, 175, 219
Input without name attribute — form submission excludes the value
react-ux-input-no-name
4INFOCAT165, 169, 175, 219
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
3INFOCAT197, 767, 916
Cyclomatic complexity 14 > 10
high-complexity
2INFOCAT273, 417
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
2INFOCAT442, 443
Non-loop variable with single-character name -- unclear intent
slop-single-letter-variable
1INFOCAT421
<button> with no text content, aria-label, or aria-labelledby — inaccessible to screen readers
ux-a11y-button-no-accessible-name
1INFOCAT197
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-55/dir-20/file-640.jsx
Health: 51.4  ·  1265 lines
FindingCtSeverityFixLines
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
315INFOSTR49–1211
Inline style object literal creates new reference every render
react-inline-style-object
86INFOCAT67–1213
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
16INFOCAT48–934
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
16INFOCAT49–935
label element must have associated input control
react-a11y-label-has-assoc
12INFOCAT164–946
Form input using defaultValue instead of value + onChange - form data cannot be validated or controlled programmatically
react-uncontrolled-input
10INFOCAT165–947
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
10INFOCAT421–1059
Input without associated label — inaccessible to screen readers and autofill
react-input-no-label
4INFOCAT165, 169, 175, 219
Form input without associated label — screen readers cannot identify purpose
react-ux-form-no-label
4INFOCAT165, 169, 175, 219
Input without name attribute — form submission excludes the value
react-ux-input-no-name
4INFOCAT165, 169, 175, 219
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
3INFOCAT197, 767, 916
Cyclomatic complexity 14 > 10
high-complexity
2INFOCAT273, 417
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
2INFOCAT442, 443
Non-loop variable with single-character name -- unclear intent
slop-single-letter-variable
1INFOCAT421
<button> with no text content, aria-label, or aria-labelledby — inaccessible to screen readers
ux-a11y-button-no-accessible-name
1INFOCAT197
+ 1 more patterns
Truemend™

Detailed Findings

dir-298/migrations/file-371.sql
Health: 60.0  ·  846 lines
FindingCtSeverityFixLines
Use double quotes for identifiers only when necessary
sql-sqlfluff-L059-quoted-identifier
392MEDIUMCAT44–798
INSERT into GENERATED ALWAYS AS IDENTITY without OVERRIDE
pg_identity_override
4MEDIUMCAT312, 492, 774, 787
CTE materialized unnecessarily
pg_cte_materialized
3MEDIUMCAT42, 324, 501
Comma-separated tables instead of JOIN
sql_implicit_join
3MEDIUMCAT314, 494, 780
Scalar subquery in SELECT list executes once per row — use JOIN instead
sql_subquery_in_select
2MEDIUMCAT34, 827
Function volatility mismatch — STABLE where IMMUTABLE possible
pg_plpgsql_volatility_wrong
1MEDIUMCAT789
HAVING used without WHERE — filters after aggregation instead of before, less efficient
sql_having_no_where
1MEDIUMCAT838
OR prevents single index use
pg_or_no_index
1INFOCAT789
RAISE without DETAIL or ERRCODE
pg_plpgsql_raise_no_detail
1INFOCAT821
Truemend™

Detailed Findings

dir-298/migrations/file-375.sql
Health: 60.0  ·  779 lines
FindingCtSeverityFixLines
Use double quotes for identifiers only when necessary
sql-sqlfluff-L059-quoted-identifier
361MEDIUMCAT39–731
INSERT into GENERATED ALWAYS AS IDENTITY without OVERRIDE
pg_identity_override
4MEDIUMCAT291, 465, 707, 720
CTE materialized unnecessarily
pg_cte_materialized
3MEDIUMCAT37, 303, 474
Comma-separated tables instead of JOIN
sql_implicit_join
3MEDIUMCAT293, 467, 713
Scalar subquery in SELECT list executes once per row — use JOIN instead
sql_subquery_in_select
2MEDIUMCAT29, 760
HAVING used without WHERE — filters after aggregation instead of before, less efficient
sql_having_no_where
1MEDIUMCAT771
RAISE without DETAIL or ERRCODE
pg_plpgsql_raise_no_detail
1INFOCAT754
dir-298/migrations/file-352.sql
Health: 60.0  ·  597 lines
FindingCtSeverityFixLines
Use double quotes for identifiers only when necessary
sql-sqlfluff-L059-quoted-identifier
313MEDIUMCAT20–570
INSERT into GENERATED ALWAYS AS IDENTITY without OVERRIDE
pg_identity_override
4MEDIUMCAT192, 320, 580, 593
CTE materialized unnecessarily
pg_cte_materialized
3MEDIUMCAT18, 206, 329
Comma-separated tables instead of JOIN
sql_implicit_join
3MEDIUMCAT194, 322, 586
Truemend™

Detailed Findings

dir-298/migrations/file-374.sql
Health: 60.0  ·  672 lines
FindingCtSeverityFixLines
Use double quotes for identifiers only when necessary
sql-sqlfluff-L059-quoted-identifier
295MEDIUMCAT49–624
INSERT into GENERATED ALWAYS AS IDENTITY without OVERRIDE
pg_identity_override
4MEDIUMCAT261, 399, 601, 614
CTE materialized unnecessarily
pg_cte_materialized
3MEDIUMCAT47, 273, 408
Comma-separated tables instead of JOIN
sql_implicit_join
3MEDIUMCAT263, 401, 607
Scalar subquery in SELECT list executes once per row — use JOIN instead
sql_subquery_in_select
2MEDIUMCAT39, 653
HAVING used without WHERE — filters after aggregation instead of before, less efficient
sql_having_no_where
1MEDIUMCAT664
RAISE without DETAIL or ERRCODE
pg_plpgsql_raise_no_detail
1INFOCAT647
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-01/dir-322/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-02/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-03/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-04/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-05/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-06/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-07/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-08/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-09/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-10/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-11/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-12/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-13/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-14/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-15/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-16/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-23/lib/file-3040.jsx
Health: 59.0  ·  1114 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
146INFOCAT52–1074
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
74INFOSTR101–1105
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
18INFOCAT54–529
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
9INFOCAT94–1035
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
9INFOCAT187–1057
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
7INFOCAT186–1056
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–481
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 659, 968
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT1059, 1061
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT582
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1113
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT582
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT582
+ 1 more patterns
Truemend™

Detailed Findings

app/__tests__/screens/dir-306/file-1180.test.tsx
Health: 68.2  ·  2105 lines
FindingCtSeverityFixLines
Cyclomatic complexity 11 > 10
high-complexity
1LOWCAT532
Over-reliance on getByTestId when accessible queries available
react-test-query-by-test-id
126INFOCAT614–2102
Test file with 5+ jest.mock/vi.mock calls — over-mocking hides integration bugs
test_mock_everything
52INFOCAT9–517
Tests using fireEvent instead of userEvent - fireEvent doesn't simulate real user behavior (no focus, no selection, no event bubbling)
react-missing-user-event-tests
39INFOCAT650–1819
jest.useFakeTimers without advanceTimersByTime or runAllTimers — timers never fire, async code hangs
jest_timer_no_advance
13INFOCAT628–2048
Test that only checks toBeDefined()/toBeTruthy() — verifies existence but not correctness of value
test_expect_tobedefined_only
8INFOCAT1040–1139
Test using shared mutable variable declared outside test blocks — test results depend on execution order
test_order_dependent
1INFOCAT284
Use optional chaining instead of manual null checks
typescript-eslint-ts-prefer-optional-chain
1INFOCAT497
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-01/dir-321/lib/file-3040.jsx
Health: 60.0  ·  1009 lines
FindingCtSeverityFixLines
Inline style object literal creates new reference every render
react-inline-style-object
124INFOCAT52–969
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
57INFOSTR101–1000
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
15INFOCAT54–440
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
8INFOCAT94–930
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
7INFOCAT187–952
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
react-ux-no-reduced-motion
6INFOCAT53–392
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
5INFOCAT186, 232, 332, 356, 951
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
4INFOCAT202, 226, 570, 863
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
3INFOCAT45, 46, 110
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
ai-ux-unsanitized-streamed-html
2INFOCAT954, 956
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
1INFOCAT493
document.getElementById/querySelector used instead of useRef — bypasses React DOM
react-useref-dom-not-cached
1INFOCAT1008
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
1INFOCAT174
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1INFOCAT493
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1INFOCAT493
+ 1 more patterns
Truemend™

Detailed Findings

app/dir-298/migrations/file-002.sql
Health: 60.0  ·  382 lines
FindingCtSeverityFixLines
FK constraint not DEFERRABLE for bulk operations
pg_no_deferrable
32MEDIUMCAT44–343
Missing CASCADE on foreign key delete
pg_missing_cascade
29MEDIUMCAT44–343
Mutable default parameter value
pg_plpgsql_mutable_default
29MEDIUMCAT34–352
Index-only scan not possible — reads table pages
pg_covering_index_missing
28MEDIUMCAT53–325
All columns nullable — no integrity enforcement
pg_nullable_everything
22MEDIUMCAT27–341
Missing NOT NULL on required columns
pg_missing_not_null
2MEDIUMCAT255, 304
JSONB column without CHECK constraint
pg_jsonb_no_check
2MEDIUMCAT33, 259
PL/pgSQL function without EXCEPTION handling
pg_plpgsql_no_exception
2MEDIUMCAT16, 368
Use double quotes for identifiers only when necessary
sql-sqlfluff-L059-quoted-identifier
1MEDIUMCAT9
Creating index that already exists
pg_create_index_redundant
30INFOCAT53–325
Table missing created_at/updated_at columns
pg_missing_timestamps
22INFOCAT27–341
CREATE TABLE without PRIMARY KEY
pg_no_pk
22INFOCAT27–341
Polymorphic association via type column
pg_polymorphic_assoc
1INFOSTR257
TEXT column without length limit for bounded data
pg_unbounded_text
1INFOCAT32
Missing UNIQUE constraint on logically unique column
pg_missing_unique
1INFOCAT45
+ 1 more patterns
Truemend™

Detailed Findings

dir-298/migrations/file-226.sql
Health: 60.0  ·  831 lines
FindingCtSeverityFixLines
IN subquery instead of EXISTS
pg_subquery_in
99MEDIUMCAT1–828
Use double quotes for identifiers only when necessary
sql-sqlfluff-L059-quoted-identifier
99MEDIUMCAT95–824
Truemend™

Detailed Findings

app/src/screens/dir-209/file-1527.tsx
Health: 44.0  ·  1727 lines
FindingCtSeverityFixLines
Touchable component missing accessibilityRole
rn-a11y-touchable-missing-role
5HIGHCAT1096, 1198, 1227, 1247, 1431
Touchable/Pressable component missing accessible label
rn-a11y-touchable-missing-label
5HIGHCAT1096, 1198, 1227, 1247, 1431
TouchableOpacity/Pressable without accessibilityLabel — invisible to screen readers (TalkBack/VoiceOver)
rn-a11y-missing-accessibility-label
5HIGHCAT1096, 1198, 1227, 1247, 1431
Image component missing accessibilityLabel
rn-a11y-image-missing-label
1HIGHCAT557
Inline style objects in JSX — creates new object reference every render, defeating shouldComponentUpdate
rn-perf-inline-style-objects
69MEDIUMCAT498–1678
Cyclomatic complexity 26 > 10
high-complexity
4MEDIUMCAT256, 950, 1300, 1584
Function is 80 lines (> 50 dynamic threshold)
function-too-long
2MEDIUMCAT950, 1584
Catch block that logs but does not re-throw or return an error — caller does not know the operation failed
cq-catch-and-ignore
1MEDIUMCAT377
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
1MEDIUMCAT261
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
1MEDIUMCAT261
Array.reduce can be replaced with simpler methods
typescript-unicorn-no-array-reduce
1MEDIUMCAT392
Inline style object literal creates new reference every render
react-inline-style-object
69INFOCAT498–1678
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
10INFOSTR767–1265
Using 'type' for object shapes that should be interfaces, or 'interface' for unions - misaligned with TypeScript best practices
ts-interface-type-confusion
8INFOCAT54–1290
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
4INFOCAT321, 371, 1655, 1660
+ 8 more patterns
Truemend™

Detailed Findings

docs/dir-101/dir-287/dir-04/dir-208/lib/file-1669.jsx
Health: 60.8  ·  842 lines
FindingCtSeverityFixLines
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
82INFOSTR131–532
Inline style object literal creates new reference every render
react-inline-style-object
67INFOCAT28–537
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
react-semantic-html-missing
8INFOCAT94–499
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
8INFOCAT7–394
label element must have associated input control
react-a11y-label-has-assoc
5INFOCAT131, 309, 449, 457, 465
Using array index as key — breaks when items reorder or insert
react-ux-array-index-key
5INFOCAT71, 420, 424, 439, 527
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
js-array-index-as-key
4INFOCAT420, 424, 439, 526
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
ux-mobile-text-no-number-of-lines
3INFOCAT73, 74, 197
Form input using defaultValue instead of value + onChange - form data cannot be validated or controlled programmatically
react-uncontrolled-input
2INFOCAT132, 310
Data table without caption or aria-label - screen reader users cannot understand the table's purpose
react-table-missing-caption
2INFOCAT341, 515
Button without text or aria-label — screen readers cannot identify
react-button-no-accessible-name
2INFOCAT273, 506
Cyclomatic complexity 11 > 10
high-complexity
1INFOCAT6
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
cq-magic-number
1INFOCAT656
Truemend™

Detailed Findings

app/src/screens/dir-43/dir-171/file-1420.tsx
Health: 38.1  ·  1391 lines
FindingCtSeverityFixLines
Inline style objects in JSX — creates new object reference every render, defeating shouldComponentUpdate
rn-perf-inline-style-objects
57MEDIUMCAT95–970
Screen header text not marked with accessibilityRole header
rn-a11y-header-missing-accessible
5MEDIUMCAT242, 578, 608, 673, 836
Cyclomatic complexity 16 > 10
high-complexity
4MEDIUMCAT469, 814, 914, 999
Function is 51 lines (> 50 dynamic threshold)
function-too-long
2MEDIUMCAT469, 999
Touchable area smaller than 44x44 minimum accessibility guideline
rn-a11y-small-touch-target
2MEDIUMMANUAL161, 162
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
react-ux-derived-state
2MEDIUMCAT1027, 1058
Effect missing dependencies — stale closures, inconsistent behavior
react-ux-effect-missing-deps
2MEDIUMCAT1027, 1058
Array.reduce can be replaced with simpler methods
typescript-unicorn-no-array-reduce
1MEDIUMCAT506
Inline style object literal creates new reference every render
react-inline-style-object
57INFOCAT95–970
JSX nesting exceeds 5 levels — hard to read and maintain
react-component-deeply-nested
15INFOSTR265–772
Hardcoded string literal used in logic — extract to a named constant or enum
cq-magic-string
11INFOCAT851–1277
useMemo wrapping a trivially cheap value - memoization overhead exceeds computation cost, adds unnecessary complexity
react-usememo-no-benefit
6INFOCAT1021–1204
<ScrollView> without showsVerticalScrollIndicator set explicitly
ux-mobile-scroll-no-indicator
5INFOCAT210, 317, 523, 654, 839
Dynamic status/loading text without aria-live region — screen readers miss content updates
react-ux-no-aria-live
3INFOCAT235, 575, 605
setState in useEffect to derive state from other state — use useMemo instead
react-useeffect-setstate-in-callback
2INFOCAT1027, 1058
+ 2 more patterns
4095 additional files with findings not shown. Run truemend audit <path> --format json for the complete list.
Truemend™

Finding Details

Most critical findings in detail

Each finding includes function metrics, evidence, recommended remediation, and the files this change can reach.

#1   __file_level__  ·  scripts/db/file-1734.py:31
CRITICAL
cataloged refactor
SQL query built with string interpolation — SQL injection risk.
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
9
Patterns
Recommended:
Review and address SQL query built with string interpolation — SQL injection risk.
Blast radius
imports thisthis importsfile-1734...file-2409...file-2397...
#2   __file_level__  ·  scripts/db/file-1734.py:31
CRITICAL
cataloged refactor
SQL query built with string concatenation or f-string — SQL injection risk
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
9
Patterns
Recommended:
Review and address SQL query built with string concatenation or f-string — SQL injection risk
Blast radius
imports thisthis importsfile-1734...file-2409...file-2397...
Truemend™

Finding Details

#3   __file_level__  ·  scripts/db/file-2395.py:68
CRITICAL
cataloged refactor
SQL query built with string interpolation — SQL injection risk.
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
6
Patterns
Recommended:
Review and address SQL query built with string interpolation — SQL injection risk.
Blast radius
No connected files in this audit set.
#4   __file_level__  ·  scripts/db/file-2395.py:68
CRITICAL
cataloged refactor
SQL query built with string concatenation or f-string — SQL injection risk
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
6
Patterns
Recommended:
Review and address SQL query built with string concatenation or f-string — SQL injection risk
Blast radius
No connected files in this audit set.
Truemend™

Finding Details

#5   __file_level__  ·  scripts/db/file-2400.py:69
CRITICAL
cataloged refactor
SQL query built with string interpolation — SQL injection risk.
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
9
Patterns
Recommended:
Review and address SQL query built with string interpolation — SQL injection risk.
Blast radius
No connected files in this audit set.
#6   __file_level__  ·  scripts/db/file-2400.py:69
CRITICAL
cataloged refactor
SQL query built with string concatenation or f-string — SQL injection risk
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
9
Patterns
Recommended:
Review and address SQL query built with string concatenation or f-string — SQL injection risk
Blast radius
No connected files in this audit set.
Truemend™

Finding Details

#7   __file_level__  ·  scripts/db/file-2411.py:37
CRITICAL
cataloged refactor
SQL query built with string interpolation — SQL injection risk.
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
19
Patterns
Recommended:
Review and address SQL query built with string interpolation — SQL injection risk.
Blast radius
this importsfile-2411...file-2397...
#8   __file_level__  ·  scripts/db/file-2411.py:37
CRITICAL
cataloged refactor
SQL query built with string concatenation or f-string — SQL injection risk
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
19
Patterns
Recommended:
Review and address SQL query built with string concatenation or f-string — SQL injection risk
Blast radius
this importsfile-2411...file-2397...
Truemend™

Finding Details

#9   __file_level__  ·  scripts/db/file-2413.py:48
CRITICAL
structural rewrite
SQL query built with string formatting — SQL injection risk. Use parameterized queries. (Source: supercent-io/skills-template@security-best-practices)
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
30
Patterns
Recommended:
Review and address SQL query built with string formatting — SQL injection risk. Use parameterized queries. (Source: supercent-io/skills-template@security-best-practices)
Blast radius
this importsfile-2413...file-3093...
#10   __file_level__  ·  scripts/db/file-2413.py:50
CRITICAL
structural rewrite
SQL query built with string formatting — SQL injection risk. Use parameterized queries. (Source: supercent-io/skills-template@security-best-practices)
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
30
Patterns
Recommended:
Review and address SQL query built with string formatting — SQL injection risk. Use parameterized queries. (Source: supercent-io/skills-template@security-best-practices)
Blast radius
this importsfile-2413...file-3093...
Truemend™

Finding Details

#11   __file_level__  ·  scripts/db/file-2413.py:54
CRITICAL
structural rewrite
SQL query built with string formatting — SQL injection risk. Use parameterized queries. (Source: supercent-io/skills-template@security-best-practices)
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
30
Patterns
Recommended:
Review and address SQL query built with string formatting — SQL injection risk. Use parameterized queries. (Source: supercent-io/skills-template@security-best-practices)
Blast radius
this importsfile-2413...file-3093...
#12   __file_level__  ·  scripts/db/file-2413.py:63
CRITICAL
structural rewrite
SQL query built with string formatting — SQL injection risk. Use parameterized queries. (Source: supercent-io/skills-template@security-best-practices)
Why it mattersThis is a critical finding. Unfixed, it can cause failures or data loss.
1
Complexity
0
Nesting
0
Lines
30
Patterns
Recommended:
Review and address SQL query built with string formatting — SQL injection risk. Use parameterized queries. (Source: supercent-io/skills-template@security-best-practices)
Blast radius
this importsfile-2413...file-3093...
+ 51712 additional findings in full report
Truemend™

Improvement Roadmap

Three-phase improvement roadmap

Fixes are classified into three tiers by execution method. Phase 1 is immediate and automated. Phase 2 requires constrained LLM assistance. Phase 3 requires human architectural judgment. Large audits use one full page per phase so the plan stays readable end to end.

Applying all Phase 1 fixes immediately removes 9 anti-patterns: with zero risk and zero cost.
Truemend™

Improvement Roadmap

Phase 1: Deterministic Fixes

Grouped by pattern so the plan stays readable even on large audits.

Phase 1: Deterministic Fixes
9 fixes · Automated · $0 cost
Python unused import (×9)
Unused import: sys
8 files
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
React inline style object (×6719)
Inline style object literal creates new reference every render
366 files
React test query by test id (×2674)
Over-reliance on getByTestId when accessible queries available
352 files
Test no aftereach cleanup (×2667)
Test suite creating resources (DOM nodes, event listeners, intervals) without afterEach cleanup
466 files
Test mock everything (×2298)
Test file with 5+ jest.mock/vi.mock calls — over-mocking hides integration bugs
314 files
Sql sqlfluff L059 quoted identifier (×1907)
Use double quotes for identifiers only when necessary
124 files
React missing user event tests (×1863)
Tests using fireEvent instead of userEvent - fireEvent doesn't simulate real user behavior (no focus, no selection, no event bubbling)
355 files
Magic string (×1611)
Hardcoded string literal used in logic — extract to a named constant or enum
330 files
Rn perf inline style objects (×1210)
Inline style objects in JSX — creates new object reference every render, defeating shouldComponentUpdate
207 files
React usememo no benefit (×1146)
useMemo wrapping a trivially cheap value - memoization overhead exceeds computation cost, adds unnecessary complexity
617 files
Pg plpgsql raise no detail (×1032)
RAISE without DETAIL or ERRCODE
264 files
High complexity (×1027)
Cyclomatic complexity 16 > 10
880 files
Visual slop tiny text (×827)
Body text below 12px is hard to read, especially on high-DPI screens. Use at least 14px for body content, 16px is ideal. AI-generated UIs frequently use 10-11px for 'clean' secondary text.
40 files
Function too long (×727)
Function is 132 lines (> 50 dynamic threshold)
596 files
Pg definer no searchpath (×660)
SECURITY DEFINER without SET search_path
272 files
Ts missing return type (×642)
Exported function without explicit return type - reduces readability and makes refactoring harder
527 files
React semantic html missing (×554)
Using div/span for navigation, header, footer, main content - screen readers cannot understand page structure
118 files
React usecallback never used as prop (×529)
useCallback wraps function never passed to memoized child — wasted overhead
156 files
Mobile text no number of lines (×526)
<Text> without numberOfLines inside a constrained-height container — text can overflow invisibly
87 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Magic number (×515)
Hardcoded numeric literal used in logic — extract to a named constant for readability and maintainability
228 files
React ux array index key (×503)
Using array index as key — breaks when items reorder or insert
159 files
Slop single letter variable (×477)
Non-loop variable with single-character name -- unclear intent
250 files
Pg no deferrable (×464)
FK constraint not DEFERRABLE for bulk operations
136 files
Js array index as key (×421)
Using array index as the sole key or identifier in callbacks like .map() breaks when items are reordered, filtered, or inserted — the index does not stably identify the item
129 files
Sql subquery in select (×373)
Scalar subquery in SELECT list executes once per row — use JOIN instead
153 files
Rn a11y missing accessibility label (×364)
TouchableOpacity/Pressable without accessibilityLabel — invisible to screen readers (TalkBack/VoiceOver)
189 files
Rn a11y touchable missing label (×363)
Touchable/Pressable component missing accessible label
189 files
React ux effect missing deps (×344)
Effect missing dependencies — stale closures, inconsistent behavior
263 files
React useeffect setstate in callback (×324)
setState in useEffect to derive state from other state — use useMemo instead
261 files
Rn responsive no safe area (×316)
Screen component without SafeAreaView — content overlaps status bar, notch, or home indicator
313 files
React default export inconsistency (×300)
Mix of default and named exports across the project - confusing import patterns, harder to refactor
300 files
Pg plpgsql mutable default (×280)
Mutable default parameter value
119 files
Css text transform uppercase (×261)
text-transform: uppercase causes screen readers to spell out letters in some cases
39 files
Pg covering index missing (×258)
Index-only scan not possible — reads table pages
110 files
React ux derived state (×257)
useState + useEffect to derive state from other state — unnecessary re-render. Use useMemo instead
211 files
Pg no transaction wrap (×250)
Migration statements not wrapped in transaction
129 files
Pg nullable everything (×238)
All columns nullable — no integrity enforcement
123 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Pg no pk (×237)
CREATE TABLE without PRIMARY KEY
122 files
React ux boolean prop naming (×234)
Boolean prop named dir-337/dir-338/dir-339/dir-340/dir-341/dir-342/dir-122/dir-343/dir-344/dir-345/dir-346/dir-347/dir-348/file-3880 without an is/has/should prefix -- unclear it's a flag
186 files
Mobile scroll no indicator (×227)
<ScrollView> without showsVerticalScrollIndicator set explicitly
175 files
Test expect tobedefined only (×217)
Test that only checks toBeDefined()/toBeTruthy() — verifies existence but not correctness of value
114 files
Any type usage (×215)
Explicit 'any' type — defeats type safety
73 files
Rn a11y touchable missing role (×213)
Touchable component missing accessibilityRole
121 files
Pg plpgsql volatility wrong (×203)
Function volatility mismatch — STABLE where IMMUTABLE possible
119 files
Ts non null assertion abuse (×202)
Excessive use of non-null assertion operator (!) - suppresses null/undefined checks, can cause runtime crashes
68 files
Tanstack query client in component (×197)
new QueryClient() inside component body — creates a new client on every render, destroys cache, causes infinite loops
186 files
Sql implicit join (×195)
Comma-separated tables instead of JOIN
82 files
Tanstack no gc time (×179)
QueryClient without gcTime configuration — default 5 minutes may be too long for memory-sensitive apps or too short for offline-first apps
168 files
Python no type hints (×176)
Function without type hints — reduces IDE support, makes refactoring dangerous
62 files
Test order dependent (×174)
Test using shared mutable variable declared outside test blocks — test results depend on execution order
121 files
Catch and ignore (×164)
Catch block that logs but does not re-throw or return an error — caller does not know the operation failed
110 files
Css hardcoded color (×161)
Hardcoded colors (`#ff0000`) instead of CSS variables
31 files
Pg subquery in (×158)
IN subquery instead of EXISTS
29 files
Double negation (×157)
!! to convert to boolean — Boolean() is clearer
109 files
Test hardcoded dates (×150)
Hardcoded date/timestamp in test — will break when dates cross boundaries or in different timezones
55 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Test global fetch mock (×145)
Global fetch/axios mock without per-test restoration — mock leaks across test files
88 files
Pg create index redundant (×142)
Creating index that already exists
48 files
Unsafe type assertion (×138)
'as any' type assertion bypasses type safety
43 files
Typescript switch exhaustive (×138)
Switch statements should be exhaustive
115 files
Dangerously set innerhtml (×138)
dangerouslySetInnerHTML used — XSS risk if content is untrusted
28 files
Tanstack no placeholder (×134)
useQuery without placeholderData or initialData — UI shows loading spinner on every key change instead of stale content
116 files
Tanstack waterfall queries (×134)
Multiple sequential useQuery calls that are independent — causes waterfall fetching instead of parallel execution
116 files
Tanstack no select transform (×134)
useQuery fetches entire API response when only a subset of fields is used — select option would reduce re-renders and memory
116 files
Tanstack no meta error context (×134)
useQuery/useMutation without meta field when using global error handler — global onError has no context about which query failed
116 files
React ux no reduced motion (×132)
CSS animation or transition without prefers-reduced-motion check — causes discomfort for vestibular disorder users
26 files
Ts interface type confusion (×126)
Using 'type' for object shapes that should be interfaces, or 'interface' for unions - misaligned with TypeScript best practices
95 files
Rn a11y header missing accessible (×125)
Screen header text not marked with accessibilityRole header
43 files
Cross test multiple acts (×121)
Test with multiple act/arrange/assert cycles — testing multiple behaviors, should be split
64 files
Write no rollback (×121)
DB write in `try` block of `run_case` has no `rollback()` in `except` — a failure leaves the DB in a partial state.
73 files
Sql injection risk (×114)
SQL query built with string interpolation — SQL injection risk.
28 files
Typescript unicorn prefer node protocol (×110)
Use node: protocol for Node.js built-in imports
110 files
Tanstack no stale time (×108)
useQuery without staleTime — default 0 means every mount triggers a refetch, wasting bandwidth
95 files
Python exit in library (×105)
sys.exit() in library code — kills calling process instead of raising exception
100 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Tanstack inline query fn (×104)
Inline arrow function as queryFn — recreated every render, prevents React Query from deduplicating and may cause unnecessary re-renders
87 files
Pg plpgsql no exception (×104)
PL/pgSQL function without EXCEPTION handling
71 files
Assert in production (×103)
assert statement used in production code (disabled with -O flag).
14 files
Tanstack no error boundary (×100)
useQuery without error handling — no throwOnError or error state check renders blank on failure
86 files
Sql like leading wildcard (×100)
LIKE with leading wildcard
51 files
Tanstack mutation no error (×99)
useMutation without onError callback — failed mutations silently swallowed, no user feedback
62 files
Rn a11y missing live region (×98)
Dynamic status text without accessibilityLiveRegion — screen reader misses real-time updates
89 files
Sql not exists vs not in (×96)
NOT IN with NULL values returns no rows — use NOT EXISTS which handles NULL correctly
69 files
React missing loading states (×95)
Async operation without loading indicator - user sees stale data or blank screen with no feedback
86 files
Sql sqlfluff L064 quoted identifier (×94)
Unnecessary quoted identifier
14 files
Empty catch (×92)
Catch block swallows the exception, with a comment explaining why
67 files
Pg missing cascade (×88)
Missing CASCADE on foreign key delete
21 files
Tanstack mutation no invalidation (×87)
useMutation without invalidateQueries in onSuccess/onSettled — stale data remains in cache after mutation, UI shows outdated values
58 files
React ux no aria live (×83)
Dynamic status/loading text without aria-live region — screen readers miss content updates
68 files
Rn a11y missing hint (×78)
Interactive component missing accessibilityHint for complex actions
49 files
Mobile pressable no feedback (×77)
<Pressable> or <TouchableOpacity> with no visual feedback configuration
48 files
React a11y prefer tag over role (×72)
Use semantic HTML element instead of ARIA role
29 files
Pg plpgsql swallow exception (×72)
EXCEPTION block swallowing errors silently
37 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
React context provider nested (×71)
Multiple Context Providers deeply nested creating provider hell
63 files
Pg missing timestamps (×71)
Table missing created_at/updated_at columns
17 files
Python format sql (×70)
SQL query built with f-string or .format() — SQL injection vulnerability
11 files
Pg cte materialized (×66)
CTE materialized unnecessarily
34 files
Sql select star (×64)
SELECT * instead of explicit columns
19 files
Typescript unicorn no array reduce (×61)
Array.reduce can be replaced with simpler methods
53 files
React a11y label has assoc (×58)
label element must have associated input control
12 files
React button no accessible name (×57)
Button without text or aria-label — screen readers cannot identify
29 files
Sql sqlfluff L042 subquery join (×57)
Join or FROM clause should not use subqueries
13 files
Jest timer no advance (×56)
jest.useFakeTimers without advanceTimersByTime or runAllTimers — timers never fire, async code hangs
34 files
Css margin auto center (×56)
margin: 0 auto for centering; consider flexbox for more robust centering
20 files
Too many locals (×54)
Function 'main' has 22 local variables (max 15)
51 files
Sql cross join (×54)
Explicit CROSS JOIN produces Cartesian product — usually unintentional
36 files
React uncontrolled input (×53)
Form input using defaultValue instead of value + onChange - form data cannot be validated or controlled programmatically
19 files
Rn a11y missing accessibility role (×52)
Interactive element without accessibilityRole — assistive technology cannot convey element purpose
29 files
Read unbounded (×50)
`read()` without a size limit loads the entire file into memory
45 files
React unnecessary fragment (×48)
React.Fragment wrapping a single child - adds unnecessary nesting
31 files
Mobile image no resize mode (×47)
<Image> without resizeMode prop — image may render at unexpected size or aspect ratio
39 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Pg public schema (×47)
Default public schema accessible to all
39 files
Rn a11y image missing label (×46)
Image component missing accessibilityLabel
40 files
Deep nesting (×46)
Nesting depth 5 > 3
42 files
Pg identity override (×46)
INSERT into GENERATED ALWAYS AS IDENTITY without OVERRIDE
14 files
Open without with (×46)
File opened without a context manager
31 files
React missing suspense error boundary (×44)
React Query / SWR data fetching without error boundary - unhandled errors show blank screen or crash
32 files
Supabase missing error check (×43)
Supabase query result destructured for data only without checking error — silent data loss on failures
26 files
Cross test depends on order (×42)
Test suite where later tests depend on state created by earlier tests — fails when run in isolation or parallel
5 files
Sql between inclusive (×41)
BETWEEN is inclusive on both ends — may include unexpected boundary values
25 files
Import time side effect (×41)
Module-level call to 'add_type()' runs on import — side effect risk.
35 files
Tanstack enabled wrong (×40)
useQuery with enabled: !!variable that can be undefined on first render — query fires then disables, causing flash
34 files
Visual slop tight line height (×40)
Line-height below 1.3 makes multi-line text hard to read. Lines need room to breathe. Use 1.5 to 1.7 for body text. AI-generated CSS often uses 1.0-1.2 to make things look 'tight'.
18 files
Cross test magic numbers (×38)
Test assertions with unexplained magic numbers — reader can't understand why 42 is the expected value
18 files
Vitest skip no issue (×37)
test.skip or it.skip without a linked issue or TODO comment — skipped tests forgotten forever
11 files
Ai ux unsanitized streamed html (×36)
Streamed AI response content rendered via dangerouslySetInnerHTML/v-html with no sanitizer nearby — model output is attacker-influenceable through prompt injection, so this is stored/reflected XSS via the AI response itself
18 files
Mobile form no keyboard avoiding (×34)
Form with <TextInput> but no <KeyboardAvoidingView> ancestor — keyboard covers input fields
22 files
Boolean parameter (×34)
Function called with multiple positional boolean literals — ambiguous at the call site since a reader can't tell what true/false mean without checking the signature
8 files
Supabase getsession for auth (×33)
getSession() used for auth verification instead of getUser() — getSession trusts the JWT without re-validating with the server, allowing stale or revoked tokens
27 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Css fixed width (×33)
Fixed width in px breaks on different screen sizes; use max-width or responsive units
26 files
Python not using pathlib (×33)
os.path usage instead of pathlib — pathlib provides a cleaner, object-oriented filesystem API
13 files
Rn responsive hardcoded dimensions (×30)
Hardcoded pixel dimensions for layout containers — UI breaks on different screen sizes and orientations
24 files
Slop magic number (×30)
Numeric literal without a named constant -- unclear intent
28 files
Pg lost update (×30)
Lost update — last write wins without check
6 files
Multiple writes no transaction (×30)
Function `setup` contains 2 DML `cursor.execute()` calls without an explicit transaction (BEGIN/COMMIT or context manager).
17 files
Too many statements (×30)
Function 'main' has 133 statements (max 50)
27 files
Pg plpgsql select star (×30)
SELECT * in PL/pgSQL breaks on schema changes
19 files
Pg or no index (×30)
OR prevents single index use
22 files
Css filter blur perf (×29)
Large blur() values on non-composited elements cause severe rendering lag
9 files
Pytest print in test (×29)
print() statements in test functions — debug logging left in, pollutes test output
8 files
Rn a11y image no accessible label (×28)
Image component without accessible and accessibilityLabel — screen readers skip or announce gibberish
24 files
React ux no react memo (×27)
List item component without React.memo — re-renders all items on any change
26 files
Rn loading flatlist no empty (×27)
FlatList without ListEmptyComponent — user sees blank screen when data is empty
23 files
Typescript unicorn no console spaces (×27)
Console log with leading/trailing spaces is likely a mistake
11 files
Rn responsive no keyboard avoiding (×26)
Form with TextInput not wrapped in KeyboardAvoidingView — keyboard covers input fields
16 files
Css font shorthand (×26)
font shorthand resets font-size, line-height, font-family unexpectedly
1 file
Subprocess no timeout (×26)
`subprocess.run` called without a timeout
13 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Sql union all distinct (×26)
UNION ALL should be used instead of UNION when duplicates are acceptable — UNION performs unnecessary DISTINCT operation
13 files
React usememo missing dep (×25)
useMemo dependency array omits variable used in computation — stale cached value
19 files
Pg plpgsql if new old (×25)
Trigger checking NEW but not OLD for UPDATE
21 files
Pg missing not null (×24)
Missing NOT NULL on required columns
20 files
React autofocus accessibility (×23)
Auto-focusing an element without checking prefers-reduced-motion or user preferences - jarring for some users
17 files
Supabase select star (×23)
.select('*') fetches all columns — wastes bandwidth and may leak sensitive fields. Select only needed columns.
15 files
Rn perf anonymous renderitem (×23)
Anonymous arrow function in FlatList renderItem — creates new function reference every render, breaking memoization
22 files
Visual slop side tab border (×23)
Thick colored border on one side of a card or list item — the most recognizable AI card template tell. Use a subtler accent (background tint, leading icon) or remove it entirely.
10 files
Sql no where update (×23)
UPDATE without WHERE
10 files
React a11y no autofocus (×22)
autoFocus can disrupt screen reader navigation
16 files
React useref dom not cached (×22)
document.getElementById/querySelector used instead of useRef — bypasses React DOM
22 files
Test no assertions (×22)
Test 'test_classify' has no assertions or pytest.raises
2 files
React table missing caption (×21)
Data table without caption or aria-label - screen reader users cannot understand the table's purpose
19 files
Cross mock returns mock (×20)
Mock configured to return another mock — creates infinite mock chains, tests verify nothing real
17 files
React magic numbers (×20)
Unexplained numeric literals in code - unclear what the number represents, hard to maintain
16 files
React usememo empty deps computation (×20)
useMemo with empty deps but computation references scope variables — stale forever
17 files
React ux input no name (×20)
Input without name attribute — form submission excludes the value
9 files
Sql injection string concat (×20)
SQL query built with string concatenation or f-string — SQL injection risk
14 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Token in logs (×19)
Auth token, JWT, or password logged to console or logger — credentials persisted in log storage
13 files
Css z index war (×19)
z-index values over 100 indicate z-index wars; use a z-index scale
19 files
Css text decoration none link (×19)
Removing underlines from links reduces discoverability for users who rely on them
19 files
React ux no focus trap (×18)
Modal or dialog component without focus trap — keyboard users can tab behind the modal into invisible content
14 files
Too many parameters (×18)
Function has 6 parameters (max 5)
15 files
Css stylelint selector max universal (×18)
Universal selector (*) is inefficient
18 files
Typescript eslint ts prefer optional chain (×17)
Use optional chaining instead of manual null checks
14 files
React component name not pascal (×17)
Component function not PascalCase — React treats as HTML tag
17 files
Ts any type variable (×17)
Variable typed as 'any' - disables all type checking for that value, hides bugs
13 files
Excessive usestate (×17)
7 useState hooks (> 5)
17 files
Css zero unit (×17)
`0px`/`0em` instead of `0` (unit is unnecessary)
7 files
Too many arguments (×17)
Function 'try_insert' has 6 parameters (max 5)
15 files
Sql concat in where (×17)
Concatenation in WHERE clause
10 files
Rn a11y text input missing label (×16)
TextInput missing accessible label or linked Text label
11 files
Ai redundant type assertion (×16)
Type assertion to the same type the value already has — no-op that adds noise
15 files
React input no label (×16)
Input without associated label — inaccessible to screen readers and autofill
7 files
React ux form no label (×16)
Form input without associated label — screen readers cannot identify purpose
7 files
Pg grant too broad (×16)
GRANT ALL on schema — excessive privileges
8 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Sql temp table overhead (×16)
Temporary table created for single-use query — CTE or derived table more efficient
12 files
Supabase hardcoded url (×15)
Hardcoded Supabase project URL in source code — should use environment variable
8 files
Css animation infinite (×15)
animation: infinite causes constant repaints and drains battery on mobile
7 files
Pg drop column active (×15)
Dropping column still referenced by views or functions
2 files
Pg temp table no cleanup (×15)
Temporary table created without DROP
11 files
Typescript eslint ts no unsafe assignment (×14)
Do not assign unsafe any values
10 files
Tsx unused import (×14)
Unused import: FF_VALUE_FONT_FAMILY
14 files
Cross test modifies global state (×14)
Test modifies global/static state without restoration — affects all subsequent tests unpredictably
6 files
React ux effect missing cleanup (×14)
Effect with subscription/timer without cleanup — memory leak
14 files
Ts unused parameters (×14)
Function 'makeStyles' never reads parameter(s) colors
13 files
React component not memoized (×14)
Expensive component not wrapped with React.memo — re-renders unnecessarily
12 files
Sql having no where (×14)
HAVING used without WHERE — filters after aggregation instead of before, less efficient
14 files
Ai config seed missing (×13)
Deterministic use case without seed — non-reproducible outputs
6 files
A11y input no label (×13)
<input> without associated <label>, aria-label, or aria-labelledby — form field has no accessible name
7 files
React a11y click events key (×13)
Clickable element missing keyboard event handler
8 files
React a11y interactive focus (×13)
Interactive element should have focus handler
8 files
React onclick not keyboard (×13)
onClick on non-interactive element without keyboard support
8 files
Typescript eslint a11y click events have key events (×13)
Clickable elements should have keyboard event handlers
8 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Typescript eslint a11y interactive supports focus (×13)
Interactive elements should have focus handlers
8 files
Typescript click events key (×13)
Clickable elements should have keyboard event handlers
8 files
Typescript interactive focus (×13)
Interactive elements should be focusable
8 files
Css deep nesting (×13)
Deeply nested selectors (4+ levels) increase specificity and coupling
6 files
Rn dark hardcoded colors (×12)
Hardcoded color hex values in styles — breaks dark mode and theme customization
9 files
Typescript biome no children prop (×12)
Passing children as prop instead of JSX children
3 files
A11y button no accessible name (×12)
<button> with no text content, aria-label, or aria-labelledby — inaccessible to screen readers
4 files
React a11y no static interaction (×12)
Non-interactive element assigned click handler
7 files
Typescript eslint a11y no noninteractive element interactions (×12)
Do not add click handlers to non-interactive elements
7 files
Typescript eslint a11y no static element interactions (×12)
Do not add event handlers to static elements
7 files
Typescript no static interaction (×12)
Non-interactive elements should not have event handlers
7 files
Css outline none (×12)
`outline: none` or `outline: 0` removes focus indicators, breaking keyboard accessibility
8 files
Sql date arithmetic (×12)
String concatenation for date arithmetic — use DATEADD/INTERVAL functions
9 files
Python percent format (×12)
Old-style % string formatting — use f-strings or str.format() for better readability and safety
5 files
React ux div with click (×11)
<div> with onClick but no role="button" — not recognized as interactive by assistive technology
6 files
Unused assignment (×11)
Variable 'file' is assigned but never read in function 'classify'.
9 files
Pg plpgsql return query (×11)
RETURN QUERY in loop — multiple result sets
7 files
Pg hba trust (×11)
pg_hba.conf using trust authentication
10 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Pg batch insert loop (×11)
INSERT in loop instead of multi-row INSERT
6 files
Boolean blindness (×10)
Multiple boolean parameters make call sites unreadable — what does fn(true, false, true) mean?
8 files
Kotlin exception broad (×10)
Catching Exception too broadly — catches unexpected exceptions
3 files
React ux props to state (×10)
Copying props to state via useState(props.x) — creates stale state that diverges from parent updates
8 files
Typescript eslint react no unknown property (×10)
Do not use unknown DOM properties on HTML elements
3 files
Bash array append loop (×10)
Array built by appending in a loop is slow; prefer mapfile/readarray for line-based input
3 files
Supabase untyped client (×9)
createClient called without a Database generic type — loses end-to-end type safety and autocomplete on table names and columns
7 files
Kotlin synchronized vs mutex (×9)
Using synchronized block in coroutine code — blocks the thread instead of suspending
1 file
Css resize none textarea (×9)
resize: none on textareas prevents users from expanding to see content
8 files
Redundant return await (×9)
return await where await is unnecessary
4 files
Pg lateral misuse (×9)
LATERAL causing N+1 pattern
6 files
React useeffect as derived state (×8)
useEffect + setState to compute derived state - introduces unnecessary render cycle and complexity; should compute inline or use useMemo
7 files
Slop excessive null coalescing (×8)
Chain of 3+ null coalescing operators -- indicates poorly typed data
7 files
Pg missing unique (×8)
Missing UNIQUE constraint on logically unique column
8 files
Json load unbounded (×8)
`json.load()` loads the entire JSON document into memory
8 files
Bash here string (×8)
<<< not POSIX here-string
3 files
Unguarded attribute access (×8)
Attribute '.group' on 'search()' result without None check
3 files
Dead feature flag (×8)
Feature flag that is always true/false — the conditional is dead code
2 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Cross test imports secrets (×7)
Test imports production secrets, API keys, or credentials — risk of leaking in CI logs or snapshots
6 files
Async form no submit disable (×7)
Form submit button not disabled during submission — allows double-submit
7 files
Tanstack no query client defaults (×7)
QueryClient created with no defaultOptions — every query inherits aggressive defaults (staleTime: 0, retry: 3, gcTime: 5min)
7 files
React usestate functional update missing (×7)
setState called with a value that depends on current state without using the functional updater - race conditions with batched updates
5 files
React console log production (×7)
console.log, console.warn, or console.error left in production code - leaks sensitive info, clutters browser console
2 files
React hardcoded text (×7)
User-facing strings hardcoded in JSX — prevents i18n
5 files
Shared mutable test state (×7)
Module-level mutable variable in test file risks state leakage between tests.
7 files
Pg generated stored (×7)
GENERATED ALWAYS AS STORED on expensive computation
4 files
React useref forwardref not used (×6)
Ref forwarded via custom prop instead of forwardRef
3 files
Empty catch block (×6)
Empty catch block silently swallows errors — at minimum log the error
2 files
Kotlin generic catch no log (×6)
Generic catch block without logging — errors are silently swallowed, making debugging impossible
2 files
Slop unnecessary variable (×6)
Variable assigned and immediately returned or used only once -- adds no clarity
6 files
Rn a11y nested touchables (×6)
Nested touchable components — assistive technology cannot determine which element to activate
4 files
Pg jsonb no check (×6)
JSONB column without CHECK constraint
5 files
Css magic number (×6)
Magic numbers (arbitrary values) reduce readability; use variables or calc()
5 files
Typescript eslint a11y no onchange (×6)
Do not use onChange on select — use onBlur for accessibility
2 files
Visual slop layout animation (×6)
Animating width, height, padding, margin, top, left, right, or bottom causes layout thrash and janky performance. Use transform and opacity instead, or grid-template-rows for height animations. AI-generated CSS frequently animates layout properties.
6 files
Slop redundant string format (×6)
f-string with no placeholders — drop the f/ format() and use a plain string
4 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Pg fulltext missing (×6)
Text search using LIKE instead of tsvector
3 files
Pg function index misuse (×6)
Function on indexed column prevents index use
6 files
Sql function in where (×6)
Function on column in WHERE clause prevents index usage
4 files
Yaml missing document start (×5)
Missing --- at document start in multi-doc files
5 files
React onload attribute (×5)
Inline event handler string instead of React event prop — XSS risk
3 files
Typescript unused import (×5)
Unused import: TagRow
5 files
Kotlin unsafe cast as (×5)
Unsafe cast with 'as' without null check — throws ClassCastException at runtime if type does not match
2 files
React context no provider (×5)
useContext called but Provider likely missing from component tree
5 files
Rn responsive dimensions get static (×5)
Dimensions.get() called at module level — value is cached and stale after rotation or split-screen
5 files
God switch (×5)
Switch statement with 26 cases (>= 10) — use a lookup map or strategy
4 files
Ts missing generic constraints (×5)
Generic function/type without proper constraints - accepts any type when it should be restricted
3 files
React state setter not used (×5)
useState declared but setter never called — should be const
4 files
Rn a11y missing accessibility state (×5)
Toggle/checkbox without accessibilityState — screen reader cannot convey checked/selected/expanded state
4 files
Unused function (×5)
Non-exported function 'resolvePrimaryClassId' has no references in its module — dead code
4 files
Tanstack hooks in query fn (×5)
React hooks called inside queryFn — queryFn is not a component or hook, violates rules of hooks and causes runtime errors
5 files
React state boolean redundant (×5)
Boolean toggle using !currentValue instead of functional update — stale state risk
5 files
Rn a11y switch missing label (×5)
Switch component missing accessibilityLabel
2 files
Typescript eslint a11y anchor is valid (×5)
Anchor elements should have valid href
5 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Too many return statements (×5)
Function 'main' has 25 return statements (max 6)
5 files
Python bugbear ambiguous variable name (×5)
Ambiguous variable name (l, I, O)
2 files
Sql order by concat (×5)
ORDER BY with concatenated column
5 files
Ai over commented obvious (×4)
Comment that restates what the code does — adds noise without insight
3 files
Kotlin broadcastreceiver unregister (×4)
BroadcastReceiver registered but not unregistered — memory leak, receives events after component destroyed
2 files
Bash shellcheck SC2103 subshell cd (×4)
Standalone cd changes the shell's working directory; a subshell would scope it
3 files
Rn loading no activity indicator (×4)
Loading state renders empty View or null — user sees blank screen with no loading feedback
4 files
Error string comparison (×4)
Comparing error message strings for error handling — fragile, breaks with any message change
2 files
React a11y media has caption (×4)
Media element should have captions
3 files
A11y no lang attribute (×4)
<html> without lang attribute — assistive technologies cannot determine page language
4 files
Pg unbounded text (×4)
TEXT column without length limit for bounded data
4 files
Css important overuse (×4)
`!important` indicates specificity problems
3 files
React ux inline function props (×4)
Inline function in props — creates new reference on every render, breaks memoization
3 files
React ux object state spread (×4)
Updating object state with spread — easier to use useImmer or reducer
1 file
Typescript eslint a11y prefer tag over role (×4)
Use semantic HTML element instead of ARIA role
3 files
Bash shellcheck SC2191 eval array (×4)
eval prevents proper array handling
1 file
Python pylint C0209 consider using f string (×4)
Consider using f-string instead of % or .format()
3 files
Typescript no any (×4)
Type annotation uses any
1 file
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Pg recursive cte no limit (×4)
Recursive CTE without termination limit
3 files
Pg no if exists (×4)
DROP without IF EXISTS — fails on re-run
4 files
React context default value mismatch (×3)
createContext with undefined/null default causes runtime errors when provider missing
3 files
Js object keys foreach (×3)
Using Object.keys(obj).forEach() to iterate object entries when Object.entries() is available — causes double lookup (get key, then access obj[key]) and is less readable
2 files
Ai redundant variable (×3)
Variable assigned and immediately returned on the next line — unnecessary indirection
3 files
React z index arms race (×3)
Very high z-index values (9999+) suggesting a z-index arms race - fragile and unmaintainable stacking context
3 files
React nested component (×3)
Component defined inside another component is re-created every render
2 files
React usestate initializer not lazy (×3)
useState initializer calls an expensive function directly instead of passing a function - function runs on every render instead of only on mount
2 files
Api ux unbounded query (×3)
Database query without LIMIT clause — can return millions of rows and crash the server
1 file
Slop redundant boolean cast (×3)
Explicit boolean cast on a value already used in boolean context
2 files
React state array push mutate (×3)
Array state mutated with push/splice — React skips re-render
3 files
Mobile flatlist no key extractor (×3)
<FlatList> without keyExtractor prop — causes inefficient re-renders
3 files
React missing roles (×3)
Custom interactive element without appropriate ARIA role - assistive technology cannot identify the element's purpose
2 files
Typescript eslint react jsx no useless fragment (×3)
Fragments should not have only a single child
2 files
Css empty ruleset (×3)
Empty rulesets are dead code and should be removed
3 files
Drizzle hardcoded connection string (×3)
Hardcoded database connection URL with embedded credentials — secrets exposed in version control
1 file
Slop unused parameter (×3)
Parameter `sender_auth` of `typing_receive` is never read in the function body
3 files
Json dumps no default (×3)
json.dumps() on a call/attribute result without a `default=` handler.
3 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Broad except no reraise (×3)
Broad exception caught and discarded without logging or re-raising
3 files
Typescript hardcoded ip (×3)
IP address literal written into the source
1 file
Sql serializable missing (×3)
Phantom reads possible
3 files
Pg type mismatch (×3)
Data type mismatch between FK columns
2 files
Sql sqlfluff L031 join alias (×3)
Avoid table aliases in join conditions
3 files
Rn a11y pressable disabled no hint (×2)
Disabled Pressable/TouchableOpacity without accessibilityState or hint explaining why
2 files
Js throw string (×2)
Throwing a string instead of an Error object loses the stack trace, makes catch blocks inconsistent (err.message fails), and breaks error monitoring tools that expect Error instances
2 files
Javascript unused import (×2)
Unused import: readdirSync
2 files
Tanstack optimistic no rollback (×2)
Optimistic update in onMutate without onError rollback — failed mutations leave cache in inconsistent state
2 files
Api ux n plus one (×2)
Database query inside a loop — causes N+1 query problem with severe performance degradation
2 files
Rn perf flatlist no key extractor (×2)
FlatList without keyExtractor — React Native falls back to index keys, causing render bugs on reorder
2 files
React ux boolean prop naming js (×2)
JS/JSX boolean prop named dir-338/dir-340/dir-341/dir-122/dir-344/dir-345/dir-346/dir-347/dir-348/file-3880 (defaulted to true/false) without an is/has/should prefix -- unclear it's a flag
2 files
React a11y mouse events key (×2)
Element with onMouseOver/onMouseOut missing focus handlers
1 file
React ux click keyboard gap (×2)
onClick handler on non-button element without onKeyDown — keyboard users cannot activate the element
2 files
React role not semantic (×2)
ARIA role on div when semantic element exists
2 files
Typescript prefer tag over role (×2)
Semantic HTML elements should be preferred over ARIA roles
2 files
A11y role misuse (×2)
role="button" on <div> — should use native <button> element instead
2 files
Bash signal handler trap (×2)
Trap handlers doing too much cause re-entry issues
2 files
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Bash string replace (×2)
String replace ${var//pattern/repl} is bash
1 file
Bash file descriptor leak (×2)
File descriptor opened but never closed leaking system resources in long-running scripts
2 files
Python comprehensions unnecessary dict comprehension (×2)
Dict comprehension that only copies its pairs — use dict() (flake8-comprehensions C416)
2 files
Environ no default (×2)
os.environ["X"] raises KeyError if the variable is missing.
2 files
Unused cli flag (×2)
CLI flag '--env-file' (dest='env_file') is defined but never accessed via args.env_file.
1 file
Python hardcoded path (×2)
Hardcoded filesystem path — breaks cross-platform compatibility and environment portability
2 files
Anthropic unbounded history (×2)
Conversation history appended every turn with no truncation/window logic -- token cost grows unbounded per session
1 file
Prompt history unbounded growth (×2)
Conversation history is appended to on every turn with no truncation/cap nearby -- unbounded token cost and eventual context-window overflow
1 file
Test setup in test body (×2)
Database/API setup duplicated in each test body instead of shared beforeEach — violates DRY
1 file
Slop excessive method chaining (×2)
Method chain with 6+ calls -- hard to debug and trace errors
1 file
Sql in clause concat (×2)
IN clause built by concatenation
2 files
Pg truncate fk (×2)
TRUNCATE on table with foreign key references
2 files
Rn loading no error boundary
Top-level component tree without ErrorBoundary — unhandled errors crash the entire app
1 file
Rn dark no appearance hook
App has no useColorScheme or Appearance API usage — dark mode preference is ignored system-wide
1 file
Typescript biome no useless this alias
this alias is unnecessary with arrow functions
1 file
React event handler any
Event handler typed as any — loses type safety
1 file
Comment bug
BUG comment found in code
1 file
React state reset not handled
Component state not reset when data identity changes — stale data shown
1 file
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Tanstack infinite no next page
useInfiniteQuery without getNextPageParam — infinite scroll cannot determine when to stop fetching
1 file
Tanstack infinite no initial page param
useInfiniteQuery without initialPageParam — required in v5, causes TypeScript error and runtime failure
1 file
Kotlin try catch expr inefficient
Try-catch in expression instead of runCatching — verbose
1 file
Kotlin detekt complex condition
Boolean expression too complex
1 file
Js parseint no radix
Calling parseInt() without an explicit radix relies on the implicit default — a string beginning with '0x'/'0X' is still parsed as hexadecimal, and the missing radix leaves that intent undocumented at the call site
1 file
Tanstack enabled false static
useQuery with enabled: false and no mechanism to trigger — query never executes, data is always undefined
1 file
Test private method access
Test accessing private/internal methods via bracket notation or @ts-ignore — tests implementation not behavior
1 file
Cross test network retry
Test retries on network failure — masks flaky tests instead of fixing the root cause
1 file
Typescript unicorn no await expression member
Accessing property of awaited expression unnecessarily
1 file
Supabase from template injection
.from() table name built with template literal interpolation — enables table name injection if input is user-controlled
1 file
React memo props reference wrong
React.memo used but parent passes inline objects/functions — memo never skips
1 file
Tanstack key not serializable
Query key contains non-serializable values (functions, class instances) — cache lookups fail silently
1 file
Slop callback hell
Deeply nested callbacks (>3 levels) -- pyramid of doom
1 file
Negated boolean
Boolean variable with negated name (isNotValid, hasNoItems) — use positive names and negate at usage
1 file
React missing suspense boundary
Async component or data fetch without Suspense boundary - shows blank screen or error during loading
1 file
Tanstack on success state update
Setting React state inside onSuccess callback — causes extra re-renders, deprecated pattern in v5, data is already reactive
1 file
Service locator
Using a service locator to retrieve dependencies at runtime — hides dependencies and breaks testability
1 file
React image optimization missing
Large images served without optimization (WebP/AVIF conversion, responsive srcset) - slow page load, wasted bandwidth
1 file
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
React a11y no redundant roles
Element has redundant ARIA role matching its semantic
1 file
Ai unnecessary spread copy
'obsNoPhoto' copies 'MAYA_PARENT_OBS' but is only read through — the copy allocates for nothing
1 file
Perf unoptimized image
Using <img> instead of framework-optimized Image component (next/image, expo-image)
1 file
React a11y role has required props
ARIA role missing required properties
1 file
Typescript aria role
Element has an ARIA role but lacks the attributes that role needs
1 file
React ux no skip link
Page without skip navigation link — keyboard users must tab through nav
1 file
Xlang cors wildcard
CORS allows all origins — credential theft risk
1 file
Stub pass only
Function 'log_message' body is only `pass` (stub).
1 file
Todo without issue
TODO/FIXME comment without a ticket/issue reference — tends to live forever without accountability
1 file
Bash command chain fail
Chained commands hide failures (&& vs ||)
1 file
Bash stat flags posix
stat flags vary across platforms (GNU vs BSD)
1 file
Pg correlated subquery
Correlated subquery in SELECT — runs per row
1 file
Python hasattr instead of protocol
hasattr() check instead of Protocol/ABC — duck typing without type safety, fails silently at runtime
1 file
Commit in loop
`.commit()` called inside a loop in `run` — each iteration opens a separate transaction, hurting performance and atomicity.
1 file
Python hardcoded secret
Hard-coded secret, password, or API key in source code — use environment variables or secrets manager. (Source: supercent-io/skills-template@security-best-practices)
1 file
Hardcoded secret
Potential hardcoded secret in variable 'TOKEN'
1 file
Undefined variable
Variable 'target_auth' is used but not defined in scope
1 file
Python unclosed resource
File or resource opened without context manager — risks resource leak. (Source: wshobson/agents@python-anti-patterns)
1 file
continued…
Truemend™

Improvement Roadmap

Phase 2: Cataloged Refactors (continued)

Grouped by pattern so the plan stays readable even on large audits.

Phase 2: Cataloged Refactors
46430 fixes · LLM-guided
Python open no encoding
open() without explicit encoding — uses platform default, causes cross-platform Unicode bugs
1 file
Bash for loop read lines
for loop over command output splits on whitespace not newlines breaking filenames with spaces
1 file
Bash shellcheck SC2046 word splitting
Word splitting on unquoted command substitution
1 file
Anthropic no error handling
messages.create/stream called with no surrounding try/except -- a transient 529 (overloaded) or rate limit crashes the request path
1 file
Anthropic tool use no validation
Tool-use block executed without validating its input against a schema -- the model's arguments are trusted and run directly
1 file
Ai config model in code
Model name hardcoded in application code — should be in config
1 file
Ai config no timeout
AI API call config without timeout — may hang indefinitely
1 file
Ai llm call no error handling
LLM API call (any provider) with no surrounding try/except -- a network error, rate limit, or provider outage crashes the request handler instead of returning a controlled error
1 file
Optional dep no guard
'anthropic' is an optional dependency imported without try/except guard.
1 file
None dereference
Variable 'rec' may be None when calling .items()
1 file
Http exception stack in response
HTTP response body includes an exception stack property (CWE-209)
1 file
Typescript hardcoded creds
Credential literal assigned in source
1 file
Sql no where delete
DELETE without WHERE
1 file
Sql no parameterized
String concatenation in SQL queries
1 file
Truemend™

Improvement Roadmap

Phase 3: Structural Review

Grouped by pattern so the plan stays readable even on large audits.

Phase 3: Structural Review
4663 findings · Human decision required
React component deeply nested (×4573)
JSX nesting exceeds 5 levels — hard to read and maintain
267 files
Rn a11y small touch target (×499)
Touchable area smaller than 44x44 minimum accessibility guideline
199 files
Rn a11y missing importantForAccessibility (×48)
Decorative View/Image without importantForAccessibility='no' — screen reader wastes time on non-content
31 files
React ux effect for fetching (×43)
useEffect for data fetching — should use React Query or SWR
39 files
Rn a11y list missing count (×33)
FlatList without accessibility item count for screen readers
27 files
Python sql string format (×26)
SQL query built with string formatting — SQL injection risk. Use parameterized queries. (Source: supercent-io/skills-template@security-best-practices)
4 files
Rn perf image no cache (×24)
Image.source with uri but no cache policy — images re-download on every mount, wasting bandwidth
20 files
Rn responsive platform no select (×18)
Platform-specific code using if/else instead of Platform.select — verbose and error-prone
16 files
React usecallback loop allocation (×6)
useCallback inside loop or map — violates Rules of Hooks
5 files
React composition over inheritance (×5)
Class components using inheritance to share logic - should use composition, hooks, or HOCs instead
3 files
Pg polymorphic assoc (×5)
Polymorphic association via type column
3 files
Bash hardcoded password (×2)
Password or secret string literal embedded directly in script source code
2 files
Pg dynamic sql inject (×2)
Dynamic SQL with unvalidated input
1 file
God class
Class 'file-1048' is 1380 lines (> 500) — too many responsibilities
1 file
Truemend™

UX Audit

UX Quality Audit

Truemend scanned 5550 files for UX anti-patterns across accessibility (WCAG 2.1), loading states, mobile responsiveness, component design, and performance. 5318 findings detected.

Overall UX Score

93%
93/100
Excellent — 5318 findings

Regulatory Compliance

✗ADA_Section_508
✗AODA
✗EAA_2025
✗WCAG_2.1_Level_A
✗WCAG_2.1_Level_AA
✗WCAG_2.1_Level_AAA

Category Breakdown

Accessibility
95
Component Design
95
Loading States
88
Mobile Ux
100
Performance Ux
95

UX Findings (5318 total across 46 patterns)

PatternSeverityDescriptionCountFiles
ux-async-no-empty-stateMEDIUMList .map() without empty state for zero items1875717
ux-perf-large-list-no-virtualizationHIGHLarge list rendering without virtualization574207
ux-comp-inline-styles-excessiveMEDIUMComponent has 6 inline style objects (>= 5)51299
react-ux-effect-missing-depsMEDIUMEffect missing dependencies — stale closures, inconsistent behavior263245
react-ux-derived-stateMEDIUMuseState + useEffect to derive state from other state — unnecessary re211193
ux-comp-prop-drilling-deepMEDIUMProps drilled through 3+ levels: dismiss, present, resize186128
react-ux-array-index-keyMEDIUMUsing array index as key — breaks when items reorder or insert159106
continued on next page...
Truemend™

UX Audit

UX Findings (continued 8–27 of 46)

PatternSeverityDescriptionCountFiles
ux-async-toast-no-actionMEDIUMError toast without retry/action button14369
api-ux-n-plus-oneINFODatabase query inside a loop — causes N+1 query problem with severe pe142142
ux-comp-missing-default-propsLOWOptional prop 'testID' without default value137119
ux-async-no-loadingHIGHData fetching without loading UI129116
ux-comp-no-error-boundaryMEDIUMData-fetching component without ErrorBoundary wrapper120120
ux-async-timeout-no-feedbackMEDIUMLong-running operation without timeout or progress feedback9256
ux-perf-no-lazy-loadingLOWRoute component 'GroveGemma' not code-split872
ux-comp-too-many-propsMEDIUMComponent Props interface has 10 properties (>= 10)7874
api-ux-no-connection-poolINFONew database connection created per request — exhausts connections and7878
react-ux-no-aria-liveINFODynamic status/loading text without aria-live region — screen readers 6867
ux-a11y-heading-order-skipMEDIUMHeading level skipped: h1 -> h35115
react-ux-no-reduced-motionINFOCSS animation or transition without prefers-reduced-motion check — cau4612
ux-a11y-input-no-labelCRITICAL<input> without associated label or aria-label4414
ux-async-optimistic-no-rollbackHIGHOptimistic update without error rollback handler4343
react-ux-effect-for-fetchingINFOuseEffect for data fetching — should use React Query or SWR3939
react-ux-no-react-memoINFOList item component without React.memo — re-renders all items on any c3333
ux-async-no-error-uiHIGHData fetching with error state but no error UI3026
react-ux-no-focus-trapINFOModal or dialog component without focus trap — keyboard users can tab 2222
ux-perf-no-abort-controllerMEDIUMuseEffect with fetch() but no AbortController cleanup2220
api-ux-unbounded-queryINFODatabase query without LIMIT clause — can return millions of rows and 2222
continued on next page...
Truemend™

UX Audit

UX Findings (continued 28–46 of 46)

PatternSeverityDescriptionCountFiles
react-ux-effect-missing-cleanupINFOEffect with subscription/timer without cleanup — memory leak1414
ux-a11y-div-click-handlerHIGHonClick on <div> instead of <button>137
ux-a11y-button-no-accessible-nameCRITICAL<button> with no text content or aria-label124
ux-async-network-no-offlineMEDIUMData fetching without offline/network-error handling99
react-ux-input-no-nameINFOInput without name attribute — form submission excludes the value99
react-ux-props-to-stateINFOCopying props to state via useState(props.x) — creates stale state tha88
react-ux-form-no-labelINFOForm input without associated label — screen readers cannot identify p77
ux-async-infinite-scroll-no-endMEDIUMInfinite scroll without end-of-list indicator66
ux-perf-animation-no-gpuLOWTransition on 'height' — use transform/opacity instead65
ux-a11y-no-lang-attributeHIGH<html> without lang attribute66
react-ux-div-with-clickINFO<div> with onClick but no role="button" — not recognized as interactiv66
ux-comp-too-many-effectsHIGHComponent has 8 useEffect hooks (>= 5)44
react-ux-inline-function-propsINFOInline function in props — creates new reference on every render, brea33
ux-a11y-icon-button-no-labelCRITICALIcon-only button without aria-label21
react-ux-click-keyboard-gapINFOonClick handler on non-button element without onKeyDown — keyboard use22
ux-a11y-role-misuseMEDIUMrole="button" on <div> — use native <button> instead22
react-ux-img-no-altINFOImage without alt attribute — screen readers skip or announce filename11
react-ux-object-state-spreadINFOUpdating object state with spread — easier to use useImmer or reducer11
react-ux-no-skip-linkINFOPage without skip navigation link — keyboard users must tab through na11
Truemend™

Confidential — Proprietary & Restricted

INTELLECTUAL PROPERTY NOTICE
This document and the technology described within are the exclusive intellectual property of Truemend.
Trademark & Brand
The Truemend name, wordmark, logo, and associated branding are trademarked. Unauthorized use of any Truemend marks in any medium — digital, print, or otherwise — is strictly prohibited and will be pursued.
Proprietary Technology
The three-tier fix classification system, deterministic AST transform engine, anti-pattern detection library, and AI authorship confidence scoring methodology are proprietary trade secrets protected under applicable intellectual property law.
Confidentiality & Reproduction
This document is provided in confidence to the named recipient only. Reproduction, distribution, reverse engineering, or derivation of any product, service, or methodology substantially similar to those described herein will be treated as misappropriation of trade secrets and pursued accordingly.
Any attempt to replicate, circumvent, or commercially exploit the methods, systems, or tooling described in this document without express written authorization from Truemend constitutes a violation of trade secret law and will result in legal action seeking injunctive relief and damages.
© 2026 Truemend™. All rights reserved. Truemend™ is a trademark. Unauthorized use is prohibited.