AI Project Audit · Tech report 2026-05-19

SONI-remix-new

tech audit

A complete, finding-level technical audit. 123 findings across 10 dimensions. Two routings — by dimension (one page per Charter dimension), or by theme (one long page grouped by cross-dimension themes). This index is the entrypoint, with a top-line view, the cross-cluster overview, and the stack profile excerpt.

Charter version

v0.4

Total findings

123

Launch-blocking

This audit was performed on a project remixed from a Lovable source. Of the 123 findings produced by the auditors, 5 are flagged by the remix-aware pre-filter — 5 as remix-artifacts (expected post-remix setup steps, not code defects) and 0 as platform-concerns (issues that exist outside the remixed repo). All findings remain in the report at their original severity; the flagged ones carry the Remix-context chip on their cards.

Top-line summary

55 of 123 findings are launch-blocking. The complete severity profile is below.

Kritikus

Magas

Közepes

Alacsony

Cross-cluster overview

The findings cross-reference each other in clusters. Resolving a cluster's underlying gap closes multiple findings at once.

Cluster (named)

AI cost and abuse

Hub: SCA-001

SCA-001, SEC-005, AI-005, SEC-002, AI-003, SCA-007

5 launch-blocking · 1 first-sprint · 0 backlog · 3 dimensions

Closes 5 launch-blocking findings across 3 dimensions if all members are remediated.

Stack profile

# Stack Profile - SONI-remix-new

Audit date: 2026-05-19
Client repo path: _clients/SONI-remix-new/
Last commit (HEAD): 7237266a - "Lovable update" - 2026-05-18 19:41:14 +0000
Audit mode: read-only static inspection of the working tree at HEAD

1. Detected Stack

Single-page TanStack Start app (React 19 + TypeScript) deployed as a Cloudflare Worker, with Supabase Postgres + Auth + Storage as the backend, and the Lovable AI Gateway as the LLM provider.

Frontend framework: TanStack Start 1.167.16 with TanStack Router 1.168.10 and TanStack Router Plugin 1.167.11 — file-based routing under src/routes/ plus a generated src/routeTree.gen.ts (25,742 bytes). Evidence: package.json lines 50-52; src/router.tsx.
UI library: React 19.2.0 + ReactDOM 19.2.0 with the full Radix UI primitive set (~25 packages) wired via shadcn/ui "new-york" style. components.json declares "style": "new-york", "iconLibrary": "lucide", and aliases.ui = "@/components/ui". The src/components/ui/ directory contains 46 component files.
Build tool: Vite 7.3.1 driven by @lovable.dev/vite-tanstack-config 1.4.0. Evidence: vite.config.ts calls defineConfig({ cloudflare: { viteEnvironment: { name: "ssr" } }, tanstackStart: { ... } }).
Language: TypeScript 5.8.3, strict: true in tsconfig.json (with noUnusedLocals: false, noUnusedParameters: false, noFallthroughCasesInSwitch: true, noUncheckedSideEffectImports: true). Module: ESNext / moduleResolution Bundler / target ES2022. Path alias @/ -> ./src/.
CSS framework: Tailwind CSS 4.2.1 via @tailwindcss/vite 4.2.1. tailwind.config.ts is minimal (content globs only). Single style entry: src/styles.css (189 lines). Animation helper tw-animate-css 1.3.4.
Runtime: Cloudflare Workers (Node.js compat). Evidence: wrangler.jsonc (see Section 3); vite.config.ts cloudflare: { viteEnvironment: { name: "ssr" } }; `@cloudflare/

Findings by dimension

Click a dimension to open its full finding-by-finding page.

Scalability & Performance

Code Quality & Maintainability

Findings by theme

Same 123 findings, regrouped by the 9 cross-dimension themes used in the executive report. Useful when you want to read e.g. all "legal & regulatory compliance" findings end-to-end without page-hopping.

→

View all findings by theme

123 findings · 9 themes · single long page

AI Project Audit · Tech report · index Charter v0.4 · 2026-05-19