Find what could make your codebase unsafe to keep building on.

Critical: Core code cannot be changed with reasonable confidence without widespread or unpredictable effects. High: Important areas are materially difficult or risky to change and create meaningful delivery risk. Medium: Localized problems increase effort or defect likelihood but safe change is still practical. Low: Readability, consistency, organization, or cleanup issues have little current product or delivery impact.

Critical: The current structure materially prevents a required capability, production requirement, or expected growth stage. High: A structural limitation materially affects reliability, scalability, changeability, or critical workflows and is likely to worsen with growth. Medium: Suboptimal boundaries or coupling create development friction without blocking reliable operation. Low: An improvement would make the system easier to evolve, but current product risk is low.

Critical: A realistic condition could lead to severe unauthorized access, sensitive-data exposure, privilege escalation, credential compromise, destructive action, or another serious security consequence. High: A meaningful control is absent or incorrectly implemented and could cause serious compromise under plausible conditions. Medium: Exposure or impact is limited or requires additional conditions. Low: A defense-in-depth improvement has little practical impact in the current context.

Critical: A realistic production failure could create unacceptable consequences and there is no dependable recovery path. High: Important operational controls are missing or unreliable and could cause extended outage, undetected failure, recovery uncertainty, or unsafe deployment. Medium: Existing controls have meaningful gaps that increase deployment, diagnosis, incident, or recovery effort. Low: Hardening or automation would improve efficiency without materially threatening current reliability.

Critical: Significant remediation, migration, replacement, or removal may be required before secure or supportable continued operation. High: Support status, version lag, ecosystem compatibility, or accumulated migration difficulty creates meaningful near-term risk. Medium: The dependency is behind the preferred baseline but remains reasonably supportable. Low: A newer version exists, but the current version remains supported, secure, and appropriate. Important: A major upgrade existing does not automatically make a dependency Critical.

Critical: There is no reliable source of truth for critical product behavior, or available sources materially contradict each other. High: A source exists, but important workflows or acceptance criteria are materially incomplete, outdated, or ambiguous. Medium: Core behavior is generally understood but gaps create avoidable engineering or QA uncertainty. Low: Minor documentation or traceability gaps exist while expected behavior remains clear. Existing implementation behavior may help establish context, but it is not automatically treated as the intended product specification.

Critical: There is no reliable way to verify one or more critical product workflows after a material change. High: Critical workflows have some verification, but major gaps remain across regression protection, integration behavior, failure handling, or other important scenarios. Medium: Core workflows are reasonably verifiable, but important edge cases or integrations have meaningful gaps. Low: Remaining gaps mainly affect non-critical behavior or test maintainability. Important: No automated tests does not automatically mean Critical.