the audit that produced a ranked inventory instead of a headline

A multi-surface platform — a public marketplace, several venue sites, staff tools, an operator console — accumulated hundreds of commits before anyone read the whole thing with a hostile reader's patience. The review that followed was not a penetration test built around one dramatic finding. It was an inventory: fourteen defects, ranked by what each would cost if reached, with the four severe ones named plainly.

The severe four were not exotic. A credential sitting in plain text inside deployment specifications. A publish path that anyone could call. A shared server where the tenant a request belonged to was inferred from a client-controlled header that outranked the domain, over a single connection pool, with no per-tenant filter on reads. And mocked payment paths left reachable in a production configuration, where a fallback that assumes settlement is indistinguishable from a real one.

The middle tier shows the pattern: failure messages that quote the database back to the caller, no request budget at all on the surface facing the public, a limiter keyed on an address that a proxy rewrites, cross-origin defaults left wide. The low tier is honest bookkeeping — state kept per process, demonstration seeds that belong in development only, a dependency tree nobody had scanned.

The part worth reading twice is the clean list. Bound queries throughout, tokens stored only as digests, cookie flags set, request-forgery wiring present, non-root containers, encrypted transport between services. The review said what held, and it fixed nothing: a read-only audit that did not quietly become a rewrite. What it proves is that the platform could be described to itself honestly, at the resolution where fixes are actually possible.