Skip to content

Deep-Dive Documentation Tracker

Tracks all available deep-dive areas and their completion status. Use with the BMAD document-project workflow (deep-dive mode). Last Updated: 2026-03-30 | Last Verified Against Codebase: 2026-03-30

Completion Summary

Status Count
Completed 15
Not Started 3
Total Areas 18

Completed Deep-Dives

1. Authentication System (Full-Stack)

  • Status: DONE
  • Date: 2026-02-13 | Validated: 2026-02-13
  • Output: docs/deep-dive-authentication-system.md
  • Scope: Backend Auth module + middleware + helpers + entities + events + frontend auth pages/hooks/state
  • Files Analyzed: 70+
  • LOC Scanned: ~5,500+
  • Known Issues Found: 64
  • TODOs Documented: 26
  • Review Documents:
  • docs/deep-dive-auth-review-findings.md — Adversarial review (21 findings, all resolved 2026-02-13)
  • docs/deep-dive-auth-review-meta-findings.md — Meta-review of the findings doc (14 findings, all applied 2026-02-13)
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/Auth/ (7 files)
  • saas-boilerplate/src/app/middlewares/auth.ts, hasPermission.ts
  • saas-boilerplate/src/helper/jwtHelpers.ts, hashedPassword.ts, generateOtp.ts, hasPermission.ts, checkPermissionAndThrow.ts
  • saas-boilerplate/src/shared/requestContext.ts, permissionCache.ts, permissionNormalizer.ts
  • saas-boilerplate/src/config/passport.ts, index.ts
  • saas-boilerplate/src/entity/ (10 auth-related entities)
  • saas-boilerplate/src/app/events/ (9 auth event handlers)
  • saas-boilerplate/src/app/cron/scheduleResetLoginAttempts.ts
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/services/authService.js
  • Sass-boilerplate-frontend-v1/src/api/auth/index.js
  • Sass-boilerplate-frontend-v1/src/store/slices/authSlice.js
  • Sass-boilerplate-frontend-v1/src/interceptors/axiosInstance.js
  • Sass-boilerplate-frontend-v1/src/middleware.js
  • Sass-boilerplate-frontend-v1/src/components/pages/auth/ (3 files)
  • Sass-boilerplate-frontend-v1/src/components/pages/settings/ (5 2FA files)
  • Sass-boilerplate-frontend-v1/src/hooks/useCheckPermission.js

2. Subscription & Payments System

  • Status: DONE
  • Date: 2026-02-13 | Validated: 2026-02-13
  • Output: docs/deep-dive-subscription-payments.md
  • Scope: Backend payment modules + entities + shared services + config + events/cron + frontend package UI
  • Files Analyzed: 48 (expanded from tracker estimate of 41 — added config, middleware, helper, event/cron files)
  • LOC Scanned: ~4,200+
  • Known Issues Found: 47
  • Severity Breakdown: 8 Critical, 15 High, 16 Medium, 8 Low
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/Subscription/ (5 files)
  • saas-boilerplate/src/app/modules/v1/Payment/ (4 files)
  • saas-boilerplate/src/app/modules/v1/Purchase/ (4 files)
  • saas-boilerplate/src/app/modules/v1/package/ (4 files)
  • saas-boilerplate/src/app/modules/v1/PackageCategory/ (4 files)
  • saas-boilerplate/src/app/modules/v1/Webhook/ (3 files)
  • saas-boilerplate/src/app/modules/v1/Cupon/ (4 files)
  • saas-boilerplate/src/app/modules/v1/stripe.service.ts
  • saas-boilerplate/src/shared/payment/ (4 files)
  • saas-boilerplate/src/entity/ (6 entities: Subscription, Package, PackageCategory, Payment, Purchase, Cupon)
  • saas-boilerplate/src/config/ (stripe.ts, getStripe.ts, getLemonsqueezy.ts)
  • saas-boilerplate/src/app/middlewares/requireStripe.ts
  • saas-boilerplate/src/helper/calculateDiscount.ts
  • saas-boilerplate/src/app/events/handlers/resetSubscribtionStatus.handler.ts
  • saas-boilerplate/src/app/cron/subscribtionExpire.ts
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/api/packages/ (2 files)
  • Sass-boilerplate-frontend-v1/src/components/pages/package/ (5 files)
  • Sass-boilerplate-frontend-v1/src/constants/package.js
  • User Clarifications:
  • Coupon entity is outdated — needs columns added to match service expectations
  • Package ↔ PackageCategory relationship is abandoned (orphaned feature)
  • LemonSqueezy is placeholder/future feature — not functional

Available Deep-Dive Areas

Full-Stack Features (Backend + Frontend)

3. Blog/CMS System

  • Status: DONE
  • Date: 2026-03-26 | Validated: 2026-03-26
  • Output: docs/deep-dive-blog-cms-system.md
  • Scope: Full-stack Blog/CMS: Blog CRUD (ownership-based perms), BlogCategory (hierarchical), BlogTag (ManyToOne), GenericPage (CMS), Slug generator, Public SSR/ISR pages (listing, detail, author, category, dynamic page)
  • Files Analyzed: 62 (43 backend + 35 frontend, some overlap with Public module)
  • LOC Scanned: ~13,296
  • Known Issues Found: 236 (26 Critical, 38 High, 66 Medium, 50 Low, 18 Dead Code, 20 Missing Features, 8 Accessibility, 10 Observations)
  • Severity Breakdown: 26C, 38H, 66M, 50L + 18 dead code + 8 a11y + 20 missing features + 10 observations
  • Adversarial Review: 2026-03-27 — 70 new issues found, 2 claims corrected, 1 fabrication removed. Report: _bmad-output/extra-docs/blog-cms-adversarial-review/
  • Priority: High (elevated from Medium due to 18 Critical: all blog permission checks commented out, category soft-deleted by bulk update, author pages broken, hero image field mismatch)
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/Blog/ (5 files)
  • saas-boilerplate/src/app/modules/v1/BlogCategory/ (4 files)
  • saas-boilerplate/src/app/modules/v1/BlogTag/ (4 files)
  • saas-boilerplate/src/app/modules/v1/Slug/ (4 files)
  • saas-boilerplate/src/app/modules/v1/GenericPage/ (4 files)
  • saas-boilerplate/src/app/modules/v1/Public/ (3 files — blog-related endpoints)
  • saas-boilerplate/src/entity/ (5 entities: Blog, BlogCategory, BlogTags, BlogView, GenericPage)
  • saas-boilerplate/src/shared/generateUniqueSlug.ts
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/api/blogs/ (3 files — 1 dead code)
  • Sass-boilerplate-frontend-v1/src/api/pages/index.js
  • Sass-boilerplate-frontend-v1/src/api/public/blogs.js, dynamic-page.js
  • Sass-boilerplate-frontend-v1/src/components/pages/blogs/ (8 files)
  • Sass-boilerplate-frontend-v1/src/components/pages/pages/ (4 files)
  • Sass-boilerplate-frontend-v1/src/components/pages/dynamic-page/ (1 file)
  • Sass-boilerplate-frontend-v1/src/app/(main-layout)/blogs/, author/, category/, [slug]/
  • Key Findings:
  • ALL checkPermissionAndThrow calls in blog.service.ts are COMMENTED OUT — any authenticated user can CRUD any blog
  • bulkBlogUpdateByCategory destructively soft-deletes the old category (almost certainly unintended)
  • updateBlog crashes at runtime — loads blog without relations, then accesses blog.categories.length
  • BlogTag is ManyToOne (not ManyToMany) — tags are NOT shared across blogs
  • GET /blogs/:id has no auth middleware — leaks draft content to anonymous users
  • Blog hero image always shows placeholder — API returns image but frontend reads imageUrl
  • Author pages return empty results — case-sensitive name matching against lowercased slug
  • Public view count increment never called — BlogViewCount is a dead feature
  • Not-found pages return HTTP 200 (SEO poison)
  • Blog CRUD mutations never revalidate public ISR cache — stale content for up to 1 hour
  • Legacy blog-tags.js hook has double base URL bug — tags management page broken
  • 0% test coverage across entire Blog/CMS system

4. User Management & RBAC

  • Status: DONE
  • Date: 2026-02-25 | Validated: 2026-02-25
  • Output: docs/deep-dive-user-management-rbac.md
  • Scope: Backend User/Role/Permission/InviteUser/UserSetting modules + entities + helper/shared dependencies + frontend RBAC infrastructure + all dashboard management pages
  • Files Analyzed: 80+ (35 backend + 45+ frontend)
  • LOC Scanned: ~15,600+
  • Known Issues Found: 68 (9 Critical, 15 High, 22 Medium, 22 Low)
  • Priority: High
  • Cross-References: 23 overlapping issues with Auth DD (#51-64 now owned by this DD), 23 undocumented API endpoints found vs api.md
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/User/ (4 files)
  • saas-boilerplate/src/app/modules/v1/Role/ (5 files)
  • saas-boilerplate/src/app/modules/v1/Permission/ (4 files)
  • saas-boilerplate/src/app/modules/v1/InviteUser/ (4 files)
  • saas-boilerplate/src/app/modules/v1/UserSetting/ (4 files)
  • saas-boilerplate/src/entity/ (6 entities: User, Role, Permission, UserRoles, UserSetting, InviteUser)
  • saas-boilerplate/src/helper/hasPermission.ts, checkPermissionAndThrow.ts
  • saas-boilerplate/src/shared/requestContext.ts, permissionCache.ts, permissionNormalizer.ts
  • saas-boilerplate/src/app/middlewares/contextMiddleware.ts
  • saas-boilerplate/src/seed/ (role, permission, setting seeds + data)
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/api/users/, roles/, permissions/, invited-users/
  • Sass-boilerplate-frontend-v1/src/hooks/useCheckPermission.js
  • Sass-boilerplate-frontend-v1/src/components/custom/permission-wrapper.jsx, nav-permission-wrapper.jsx
  • Sass-boilerplate-frontend-v1/src/components/pages/dashboard/users/, roles-permissions/, invited-users/
  • Sass-boilerplate-frontend-v1/src/store/slices/authSlice.js
  • Sass-boilerplate-frontend-v1/src/components/pages/auth/register.jsx (invite flow)
  • Key Findings:
  • Dual incompatible hasPermission implementations (middleware vs helper) with different permission formats
  • Permission format mismatch: middleware produces route-format plural, seed data uses dot-format singular
  • createRole and grantPermissionToRole have NO permission checks
  • Frontend create-user form calls update mutation instead of create
  • 5 frontend hooks call backend endpoints that don't exist (404s)
  • permissionNormalizer module is completely unused (all calls commented out)
  • 23 undocumented API endpoints across /roles, /permissions, /invite-users

5. Product Catalog

  • Status: DONE
  • Date: 2026-04-11 | Validated: 2026-04-11
  • Output: docs/deep-dive-product-catalog.md
  • Scope: Full-stack Product Catalog: Product CRUD (multi-image upload, pricing, categories), ProductCategory management (copied from BlogCategory), Image upload module, frontend dashboard pages (mock-only), product-performance dashboard widget
  • Files Analyzed: 23 (13 backend + 10 frontend)
  • LOC Scanned: ~2,786
  • Known Issues Found: 75 (18 Critical, 19 High, 22 Medium, 16 Low)
  • Dead Code: ~577 LOC (mock data generators, commented-out API calls, empty file, template remnant component)
  • Priority: High (elevated from Low due to 18 Critical: entire frontend mocked, permission checks missing/commented-out, field name mismatch causes data loss, BlogCategory copy-paste bugs, unseeded permissions, hard delete despite @DeleteDateColumn, unauthenticated image upload)
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/Product/ (4 files)
  • saas-boilerplate/src/app/modules/v1/ProductCategory/ (4 files)
  • saas-boilerplate/src/app/modules/v1/Image/ (3 files)
  • saas-boilerplate/src/entity/Product.ts, ProductCategory.ts
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/api/products/ (2 files — index.js is empty)
  • Sass-boilerplate-frontend-v1/src/components/pages/products/ (3 files)
  • Sass-boilerplate-frontend-v1/src/app/(dashboard-layout)/dashboard/products/ (4 pages)
  • Sass-boilerplate-frontend-v1/src/components/pages/dashboard/product-performance.jsx
  • Key Findings:
  • Entire frontend Product CRUD is mocked — every API call commented out, replaced with hardcoded mock data + setTimeout delays
  • Only ProductCategory management has real API integration (via useProductCategories hook + axios)
  • product.validation.ts field originalPrice doesn't match entity discountPrice — discount data silently lost
  • updateProduct permission check COMMENTED OUT; deleteProductById has ZERO permission check
  • ProductCategory module copy-pasted from BlogCategory: wrong validation import, wrong type cast, wrong response messages (5x "Blog" instead of "Product")
  • product-performance.jsx displays project/task data, not product metrics (template remnant)
  • Image upload endpoint (POST /uploads/image) has NO auth middleware — public upload
  • Zero product permissions seeded in database — all checkPermissionAndThrow calls fail for non-super_admin
  • Dual soft-delete pattern (isDeleted + @DeleteDateColumn) but service only checks isDeleted
  • ProductCategory uses hard delete (repo.remove()) despite having @DeleteDateColumn
  • 5 user flows traced: View (mocked), Create (mocked), Edit (mocked), Delete (local-state only), Categories (partially working)
  • 0% test coverage across all 23 files

6. Email Template System

  • Status: DONE
  • Date: 2026-02-25 | Validated: 2026-02-25
  • Output: docs/deep-dive-email-template-system.md
  • Scope: Backend EmailTemplate module + shared email services (3 providers) + entity + frontend visual DnD builder (v2) + legacy v1 + hardcoded templates + event handlers
  • Files Analyzed: 44 (4 backend module, 9 email services, 3 legacy helpers, 5 hardcoded templates, 1 entity, 1 frontend API, 20 v2 components, 6 utils, 2 legacy v1, 4 route pages)
  • LOC Scanned: ~10,600+
  • Known Issues Found: 60 (6 Critical, 10 High, 23 Medium, 21 Low)
  • Priority: High (largest single UI feature)
  • Extra Documents:
  • docs/extra-docs/email-template-attack-scenarios.md — Red Team: 5 attack chains, 2 CRITICAL (SQL injection → DB compromise, stored XSS → privilege escalation)
  • docs/extra-docs/email-template-adrs.md — 3 ADRs: unify email infra (~4h), connect DB templates to sending (~6h), delete v1 (~5min)
  • docs/extra-docs/email-template-pre-mortem.md — 7 failure scenarios with business impact
  • docs/extra-docs/email-template-root-cause-analysis.md — 5 Whys: 3 systemic root causes
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/EmailTemplate/ (4 files)
  • saas-boilerplate/src/lib/email/ (9 files: EmailFactory, NodeMailerService, ResendService, BrevoService, IEmailService, email.type, email, transporterMail, template/signupEmailVerification)
  • saas-boilerplate/src/helper/email.ts, helper/transporterMail.ts, helper/email/resend.ts
  • saas-boilerplate/src/template/ (5 hardcoded template functions)
  • saas-boilerplate/src/entity/EmailTemplate.ts
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/api/email-templates/index.js (10 React Query hooks)
  • Sass-boilerplate-frontend-v1/src/components/pages/email-templates/ (20 components + 6 utils)
  • Sass-boilerplate-frontend-v1/src/components/pages/email-templates-v1/ (2 legacy files)
  • Sass-boilerplate-frontend-v1/src/app/(dashboard-layout)/dashboard/email-templates/ (3 route pages)
  • Key Findings:
  • Critical architectural gap: EmailTemplate entity NEVER used for sending — visual builder is a dead end. All emails use hardcoded TypeScript functions in src/template/
  • SQL injection via orderBy parameter (blind conditional injection, trivially exploitable)
  • getAllTemplates has NO permission check — any authenticated user reads all templates
  • email-template.* permissions not seeded — non-super_admin permanently locked out
  • Frontend calls non-existent DELETE /bulk-permanent-delete endpoint (always 404)
  • Dual email infrastructure: MAIL_TYPE (legacy) vs EMAIL_SERVICE (factory) — different env vars, different code paths
  • dangerouslySetInnerHTML without sanitization in 2 locations (list preview + builder preview)
  • BrevoService silently swallows errors — email failures invisible
  • 3 systemic root causes: zero test coverage, super_admin-only development, no integration tracking
  • Attack chain: SQL injection → stored XSS → self-role-change = "new signup → super_admin in <5 min"
  • P0 fix: 45 minutes (orderBy whitelist + DOMPurify) blocks both CRITICAL attack chains

7. Menu Builder System

  • Status: DONE
  • Date: 2026-02-25 | Validated: 2026-02-25
  • Output: docs/deep-dive-menu-builder-system.md
  • Scope: Backend Menu/MenuItem modules + entities + seeds + frontend API/services (old+v2) + v2 components + legacy components + helpers
  • Files Analyzed: 38+ (8 backend modules, 2 entities, 6 frontend API/services, 9 v2 components, 12 legacy components, + seeds, routes, helpers)
  • LOC Scanned: ~8,900+
  • Known Issues Found: 42 (3 Critical, 7 High, 14 Medium, 18 Low)
  • Priority: Medium
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/MenuBuilder/Menu/ (4 files)
  • saas-boilerplate/src/app/modules/v1/MenuBuilder/MenuItem/ (4 files)
  • saas-boilerplate/src/entity/Menu.ts, MenuItem.ts
  • saas-boilerplate/src/seed/data/permission.ts (8 menu permissions)
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/api/menu/ (2: index.js, menu-item.js) — v2 active
  • Sass-boilerplate-frontend-v1/src/api/menu-builder/ (2: index.js, menu-label.js) — old, 9/11 endpoints broken
  • Sass-boilerplate-frontend-v1/src/components/pages/menu-builder/ (8 files) — v2 active
  • Sass-boilerplate-frontend-v1/src/components/pages/menu-builder-old/ (12 files) — legacy, still routed
  • Sass-boilerplate-frontend-v1/src/services/menuService.js, menuItemService.js — dead (dummy data)
  • Sass-boilerplate-frontend-v1/src/hooks/useMenus.js — dead (zero consumers)
  • Sass-boilerplate-frontend-v1/src/lib/menuHelpers.js — tree utilities
  • Key Findings:
  • Permission string format mismatch: menuItem.view (camelCase) vs menu-item.create (kebab-case) in same module
  • 5 permission strings used in code but NOT in seed data (menu.read, menu.restore, menuItem.view, menuItem.read, menu-item.restore)
  • 9 of 11 old API hooks call non-existent backend endpoints (including entire /menu-labels module)
  • countRootLevelItems queries wrong entity (Menu instead of MenuItem)
  • useMenu() has { limits: 1000 } bug — query param never sent
  • 3,300+ LOC of dead code identified (services, hooks, legacy components, old API)
  • No test files exist (backend or frontend)
  • Old components still accessible at /dashboard/settings/menu-builder-old

8. Contact System

  • Status: NOT STARTED
  • Priority: Low
  • Verified Scope (~9 files):
  • Backend: Contact/ (4 files)
  • Entities (1): ContactMessage.ts
  • Frontend: api/contacts/ (1), components/pages/contact-frontend/ (2), components/pages/contact-list/ (1)
  • Public route: (main-layout)/contact/page.js (shared with Blog/CMS scope)
  • Already Covered in Auth DD: None
  • Why: Contact form submission and admin review — small, self-contained feature

Backend-Only Areas

9. Middleware & API Infrastructure

  • Status: DONE
  • Date: 2026-02-16 | Validated: 2026-02-16
  • Output: docs/deep-dive-middleware-api-infrastructure.md
  • Scope: Backend middleware pipeline + API infrastructure modules
  • Files Analyzed: 19 in-scope + 15 dependency files (34 total)
  • LOC Scanned: ~2,184
  • Known Issues Found: 26 (2 Critical, 7 High, 9 Medium, 8 Low)
  • Priority: High
  • Verified Scope (19 files):
  • Middleware (13 files): middlewares/ — auth.ts, hasPermission.ts, contextMiddleware.ts, globalErrorHandler.ts, middleware.ts, rateLimiter.ts, requireStripe.ts, sanitizeQuery.ts, upload.ts, validateRequest.ts, logger.ts, sequrity.ts, swaggerAuthMiddleware.ts
  • API infrastructure (6 files): modules/v1/Swagger/swagger.route.ts (1), modules/v1/Routes/ (2: routerList.routes.ts, routes.controller.ts), modules/v1/Public/ (3: public.controller.ts, public.routes.ts, public.service.ts)
  • Already Covered in Auth DD: auth.ts, hasPermission.ts (2 of 13 middleware files — re-examined in pipeline context)
  • Key Findings:
  • middleware.ts is dead code (never imported by app.ts)
  • auth.ts refresh token validation broken (User entity has no refreshToken column)
  • Helmet security headers disabled in production (commented out)
  • routes.json missing — /api/v1/routes endpoint crashes
  • hasPermission() queries DB despite permission cache being available
  • Two parallel auth middleware implementations with different behaviors
  • Why: Request processing backbone — rate limiting, validation, error handling, security headers, file upload, Swagger docs, route listing

10a. Helper Functions, Config & DB

  • Status: DONE
  • Date: 2026-03-30 | Validated: 2026-03-30
  • Output: docs/deep-dive-helper-functions-config-db.md
  • Scope: All 33 files across helper/ (24 files incl. cloud/s3.ts + email/resend.ts), config/ (8 files incl. AppConfig.ts), db/ (1 file). All files re-examined including 7 previously covered in Auth DD.
  • Files Analyzed: 33 (24 helper + 8 config + 1 db)
  • LOC Scanned: ~1,328
  • Known Issues Found: 88 (20 Critical, 23 High, 26 Medium, 19 Low)
  • Dead Code: ~350 LOC removable across 5 dead files + 1 unused import (fileUploader.ts with leaked credentials, AppConfig.ts duplicate, calculateDiscount.ts, paginationHelper.ts, email/resend.ts superseded, unused DeleteObjectCommand import)
  • Priority: High (elevated from Medium due to 20 Critical: leaked credentials, 3x path traversal, zero file type validation, MASTER_KEY not validated, dual Stripe init, hardcoded localhost, invite-only account takeover)
  • Subagent Reports (7):
  • _bmad-output/extra-docs/file-upload-helpers-deep-dive/ — 30 issues (6C, 8H, 9M, 7L) — File upload pipeline analysis
  • _bmad-output/extra-docs/helper-utilities-deep-dive/ — Email utilities + general helpers analysis
  • _bmad-output/extra-docs/config-deep-dive/ — 47 issues (8C, 12H, 16M, 11L) — All 8 config files
  • _bmad-output/extra-docs/db-connection-and-dependency-map/ — DB connection + full dependency map
  • _bmad-output/extra-docs/code-reuse-duplication-analysis/ — Cross-codebase duplication: triple permission impl, dual email pipeline
  • Key Backend Paths:
  • saas-boilerplate/src/helper/ (22 root files + cloud/s3.ts + email/resend.ts)
  • saas-boilerplate/src/config/ (8 files: AppConfig.ts, cloudinary.ts, dbConfig.ts, getLemonsqueezy.ts, getStripe.ts, index.ts, passport.ts, stripe.ts)
  • saas-boilerplate/src/db/connection.ts
  • Key Findings:
  • fileUploader.ts has hardcoded Cloudinary API key + secret in source — 0 consumers (dead code), credentials must be rotated
  • 3 path traversal vulnerabilities in deleteFile, saveBufferToFile, handleFileUpload — no input sanitization
  • Zero file type validation across entire upload pipeline — any file type accepted
  • config/AppConfig.ts is 150 LOC duplicate of config/index.ts — 0 consumers
  • Dual Stripe initialization — stripe.ts (sync) vs getStripe.ts (async+DB fallback), some modules import BOTH
  • Triple permission implementation across codebase: helper/hasPermission.ts vs middlewares/hasPermission.ts vs middlewares/permissionMiddleware.ts
  • hasPermission.ts normalization commented out in main function but active in hasPermissionForUser() — asymmetric behavior
  • saveBufferToFile argument order swapped by LocalSotrage.ts — folder/filename reversed
  • config/index.ts has 40+ consumers — highest blast radius, any key rename is multi-file change
  • 0% test coverage across all 33 files
  • Why: Utility layer — file uploads, encryption, pagination, image processing, cloud integrations, database config

10b. Service Factories (Email, Payment, Storage, Cache)

  • Status: DONE
  • Date: 2026-03-29 | Validated: 2026-03-29
  • Output: docs/deep-dive-service-factories.md
  • Scope: 4 factory subsystems in src/lib/: Email (3 providers: NodeMailer, Resend, Brevo), Payment (Stripe + LemonSqueezy), Storage (AWS S3, Cloudinary, Local), Cache (node-cache). Plus config files, helper layer consumers, and cross-factory architectural analysis.
  • Files Analyzed: 45+ (20 lib factory files + 16 config/consumer files + helper layer)
  • LOC Scanned: ~2,200+
  • Known Issues Found: ~147 (28 Critical, 33 High, 46 Medium, 40 Low) + 6 systemic
  • Dead Code: ~434 LOC across ~10 files (entire lib/storage/ and lib/cache/ directories dead)
  • Priority: High (elevated from Medium due to 28 Critical: broken email factory, hardcoded webhook secrets, committed credentials, dead code subsystems)
  • Subagent Reports (5):
  • _bmad-output/extra-docs/email-factory-deep-dive/ — 39 issues (7C, 8H, 10M, 14L)
  • _bmad-output/extra-docs/payment-factory-deep-dive/ — 42 issues (7C, 10H, 14M, 11L)
  • _bmad-output/extra-docs/storage-factory-deep-dive/ — 42 issues (8C, 9H, 14M, 11L)
  • _bmad-output/extra-docs/cache-deep-dive/ — 22 issues (5C, 6H, 7M, 4L)
  • _bmad-output/extra-docs/factory-cross-cutting-analysis/ — Cross-factory consumer mapping, 13 competing systems
  • Actual Paths (corrected from tracker):
  • Email factory (9 files): lib/email/ — BrevoService.ts, EmailFactory.ts, IEmailService.ts, NodeMailerService.ts, ResendService.ts, email.ts (DEAD), email.type.ts, transporterMail.ts (DEAD), template/signupEmailVerification.ts (DEAD)
  • Payment factory (4 files): lib/payment/ — PaymentFactory.ts, paymentService.ts, StripeService.ts, payment.type.ts
  • Storage factory (5 files): lib/storage/ — AwsStorage.ts, CloudinaryStorage.ts, IStorageService.ts, StorageFactory.ts, LocalSotrage.ts — ALL DEAD CODE
  • Cache (2 files): lib/cache/ — cache.interface.ts, Node-cache.ts — ALL DEAD CODE
  • Related config: config/stripe.ts, config/getStripe.ts, config/getLemonsqueezy.ts
  • Related consumers: modules/v1/stripe.service.ts, modules/v1/Payment/, modules/v1/Webhook/
  • Key Findings:
  • ~11% factory adoption — only 3 of ~28 consumers use factory abstractions; rest use legacy helper/config systems
  • EMAIL_SERVICE env var missing from .env and .env.example — EmailFactory always throws, breaking registration/invite emails
  • BrevoService silently swallows all errors — emails appear sent when they failed
  • Real Gmail SMTP credentials committed in .env file
  • paymentGateway parameter completely ignored — hardcoded PaymentFactory.create("stripe")
  • LemonSqueezy webhook secret hardcoded in source code ("c3b451346788c32")
  • stripeProductId references non-existent column — runtime crash
  • Stripe cancelUrl uses {CHECKOUT_SESSION_ID} token — Stripe doesn't replace in cancel_url → 404
  • Entire lib/storage/ is dead code (5 files, ~250 LOC, zero consumers)
  • Entire lib/cache/ is dead code (2 files, ~37 LOC, zero consumers)
  • LocalStorage.upload() writes base64 text not binary — files corrupted
  • Path traversal vulnerability in LocalStorage via unsanitized filename
  • Cache TTL comments are lies: "5 minutes" = 1 hour, "1 day" = 24 minutes
  • 13 competing implementations across 4 subsystems (3 email, 4 payment, 3 storage, 3 cache)
  • Only Stripe has AppConfig encrypted DB secret support — all others plaintext env vars
  • Zero test coverage across all 4 factory subsystems

10c. Shared Utilities

  • Status: DONE
  • Date: 2026-03-29 | Validated: 2026-03-29
  • Output: docs/deep-dive-shared-utilities.md
  • Scope: All 15 shared/ top-level utilities: DB access, error handling, response formatting, permission caching/normalization, request context, CORS, slug generation, image processing, caching, query helpers, object utilities, content validation
  • Files Analyzed: 15
  • LOC Scanned: ~926
  • Known Issues Found: 108 (17 Critical, 39 High, 35 Medium, 17 Low)
  • Dead Code: pick.ts (0 consumers), dbRepository() function (0 consumers), addPermissionToCache() (0 callers), 3 single-consumer candidates (getCorsOrigins, permissionNormalizer, validatePostTypeAndId)
  • Priority: High (elevated from Low due to 17 Critical: privilege escalation via mutable permission Set, unbounded slug loop DoS, non-atomic cache, ACTION_MAPPING ignored, production console.log, falsy ID validation bypass)
  • Key Backend Paths:
  • saas-boilerplate/src/shared/ (all 15 files)
  • Key Findings:
  • getDbRepository is #1 dependency hotspot (53 consumers) — changes affect entire backend
  • permissionCache.ts returns mutable Set<string> reference — callers can escalate privileges via .add()
  • generateUniqueSlug has unbounded while loop (DoS vector) + race condition on concurrent calls
  • permissionNormalizer.ts computes ACTION_MAPPING but ignores it — root cause of format mismatches
  • normalizeImageSrc has console.log in production code
  • validatePostTypeAndId falsy check !postId skips validation for postId: 0
  • sendResponse meta field stripped from response when undefined (should be null)
  • cache.ts comment says "5 minutes" but code sets 3600s (1 hour)
  • pick.ts is entirely dead code — 0 consumers
  • Zero test coverage across ALL 15 files
  • 2 direct DataSource accesses bypass getDbRepository() wrapper
  • 5+ response sends bypass sendResponse() standardization
  • Duplicate slug generation in blog.utils.ts
  • Pagination naming mismatch: orderBy/order vs sortBy/sortOrder

11. Event System & Cron Jobs

  • Status: NOT STARTED
  • Priority: Medium
  • Verified Scope (13 files):
  • Events (10 files): events/ — eventEmitter.ts, eventTypes.ts, index.ts, handlers/inviteUserCreate.handler.ts, handlers/registerEmailHandler.ts, handlers/resetLoginAttempts.handler.ts, handlers/resetSubscribtionStatus.handler.ts, handlers/inviteOnlyLoginSendEmail.ts, handlers/sendForgotPass.handler.ts, handlers/sendLoginOtp.handler.ts
  • Cron (3 files): cron/ — index.ts, scheduleResetLoginAttempts.ts, subscribtionExpire.ts
  • Already Covered in Auth DD: 9 of 10 event handlers + scheduleResetLoginAttempts.ts already documented. Only resetSubscribtionStatus.handler.ts and subscribtionExpire.ts are new.
  • Recommendation: Given 11 of 13 files already covered in Auth DD, consider folding remaining 2 files into the Payments (#2) deep-dive instead of standalone.
  • Why: Async event-driven architecture, handler patterns, cron scheduling

12. Settings & Configuration

  • Status: DONE
  • Date: 2026-02-25 | Validated: 2026-02-25
  • Output: docs/deep-dive-settings-configuration.md
  • Scope: Backend Setting + AppConfig + UserSetting modules, entities, seeds, frontend API/store/UI, consumer components
  • Files Analyzed: 40+ (22 backend, 18+ frontend)
  • LOC Scanned: ~5,800+
  • Known Issues Found: 85 (18 Critical, 15 High, 27 Medium, 25 Low)
  • Priority: Low (elevated due to 18 critical security findings)
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/Setting/ (4 files)
  • saas-boilerplate/src/app/modules/v1/AppConfig/ (4 files)
  • saas-boilerplate/src/app/modules/v1/UserSetting/ (4 files)
  • saas-boilerplate/src/entity/Setting.ts, AppConfig.ts, UserSetting.ts
  • saas-boilerplate/src/seed/data/setting.ts, seed/setting.seed.ts
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/api/settings/ (2 files)
  • Sass-boilerplate-frontend-v1/src/api/public/settings.js
  • Sass-boilerplate-frontend-v1/src/store/slices/settingSlice.js
  • Sass-boilerplate-frontend-v1/src/components/pages/settings/ (8 files)
  • Key Findings:
  • 3 separate config systems with inconsistent quality (Setting, AppConfig, UserSetting)
  • All Setting GET endpoints fully public — setting.view perm seeded but never used
  • AppConfig has zero permissions seeded — permanently super_admin-only
  • twoFactorSecret stored plaintext and returned in API responses
  • GET /user-settings/ lists ALL users' 2FA settings without permission check
  • useSetupTwoFactor uses useQuery for side-effecting PUT — regenerates TOTP on mount
  • useBackupCodes uses useQuery for POST — overwrites codes on refetch
  • Frontend has 3 caching strategies that can desync (React Query + Redux + unstable_cache)

13. Logging & Analytics

  • Status: DONE
  • Date: 2026-04-11 | Validated: 2026-04-11
  • Output: docs/deep-dive-logging-analytics.md
  • Scope: Backend Logger module (1 file) + Analytic module (4 files) + Logger entity (1) + logging infrastructure (3: middlewares/logger.ts, helper/httpLogger.ts, transporter/PostgresTransport.ts) + Frontend dashboard pages (3 versions + charts V1/V2) + widgets (9) + data tables/charts (8) + API hook (1 + 1 duplicate)
  • Files Analyzed: 34 (9 backend + 25 frontend)
  • LOC Scanned: ~5,800
  • Known Issues Found: 64 (9 Critical, 14 High, 23 Medium, 18 Low)
  • Dead Code: ~2,345 LOC removable (V1/V2 dashboards ~2,163 LOC, disabled logging pipeline ~182 LOC)
  • Priority: High (elevated from Low due to 9 Critical: entire HTTP logging pipeline dead, analytics no permission check, no caching ~20 queries/call, 3 frontend-backend data mismatches, broken props destructuring, 100% hardcoded dummy component)
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/Logger/logger.service.ts
  • saas-boilerplate/src/app/modules/v1/Analytic/ (4 files)
  • saas-boilerplate/src/entity/Logger.ts
  • saas-boilerplate/src/app/middlewares/logger.ts
  • saas-boilerplate/src/helper/httpLogger.ts
  • saas-boilerplate/src/app/transporter/PostgresTransport.ts
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/api/dashboard/index.js
  • Sass-boilerplate-frontend-v1/src/hooks/useDashboardData.js (duplicate)
  • Sass-boilerplate-frontend-v1/src/components/pages/dashboard/dashboard-page-v3.jsx (active)
  • Sass-boilerplate-frontend-v1/src/components/pages/dashboard/dashboard-page-v2.jsx (dead)
  • Sass-boilerplate-frontend-v1/src/components/pages/dashboard/dashboard-page.jsx (dead)
  • Sass-boilerplate-frontend-v1/src/components/pages/dashboard/widgets/ (9 files)
  • Sass-boilerplate-frontend-v1/src/components/pages/dashboard/charts*.jsx, weekly-stats.jsx, payment-gateways.jsx, product-performance.jsx, expense-pi-chart.jsx, sales-bar-chart.jsx, recent-*.jsx, yearly-sales*.jsx, welcome-section.jsx
  • Key Findings:
  • httpLogger middleware is NEVER REGISTERED — imported in app.ts but never app.use()'d, commented out in middleware.ts. The entire Logger entity / LoggerService / PostgresTransport pipeline is dead code.
  • Analytics endpoint has NO permission check — auth() with no arguments, any authenticated user sees user emails and payment amounts. No analytics.view permission seeded.
  • No caching — ~19-24 DB queries per API call despite importing getCache/addCache. 3 unused imports.
  • 3 critical frontend-backend mismatches: totalGames/thisMonthGames (ghost gaming metrics, always 0), totalUpvotes/widgets.upvotes (UpvotesStatCard permanently broken), blogWithAuthor.today vs frontend day key ("Today" filter broken)
  • V1 and V2 dashboard pages are 100% dead code — zero imports across codebase. Only V3 is rendered. ~2,163 LOC dead frontend code.
  • /dashboard/analytics is a stub — renders only <div>Overview Page</div>
  • Two chart libraries bundled (ApexCharts + Recharts) — consolidation opportunity
  • useDashboard error swallowed — catch block doesn't re-throw, React Query isError never true, all error UI unreachable
  • BlogsStatCard duplicates 150 LOC from StatCard instead of composing it (⅘ other cards use correct thin-wrapper pattern)
  • Icons swapped: contacts has FileText, payments has MessageSquare, blogs has Gamepad2 (gaming leftover)
  • sales-bar-chart.jsx props destructuring broken: (data, totalSales) instead of ({data, totalSales}) — renders nothing
  • 0% test coverage across all 34 files
  • Only active Winston consumer: inviteUserCreate.handler.ts calling logger.error() directly

Frontend-Only Areas

14. Landing Page & Public Site

  • Status: DONE
  • Date: 2026-02-25 | Validated: 2026-02-25
  • Output: docs/deep-dive-landing-page-public-site.md
  • Scope: Full-stack public-facing pages: landing page (13 components), blog system (listing/detail/author/category), contact form, dynamic pages, navigation, supporting backend modules (Public/Blog/GenericPage/Setting/Contact/Menu)
  • Files Analyzed: 81 (22 backend + 13 landing components + 7 route pages + 7 page components + 7 layout components + 7 API modules + 2 server actions + 1 middleware + 3 services + 12 DB entities)
  • LOC Scanned: ~8,200+
  • Known Issues Found: 70 (7 Critical, 10 High, 30 Medium, 23 Low) -- 45 original + 25 from Expert Panel
  • Priority: Low (elevated to High due to 7 Critical: 5x broken caching + 2x stored XSS)
  • Elicitation Analyses (5 methods applied):
  • Red Team vs Blue Team: 7 attack chains, full platform takeover in 8 steps, P0 fix = 15 min
  • Pre-mortem: 9 failure scenarios, ship-blocker list, ~3-hour fix estimate
  • Expert Panel: 25 new issues (#46-#70) -- GenericPage data leak, sequential API calls, null-safety crashes, a11y gaps
  • ADRs: 5 decisions (caching migration, sanitization, CTA wiring, SEO infra, CI pipeline), 23-31h total
  • 5 Whys: 4 systemic root causes (no CI, copy-paste dev, visual-demo mindset, no security discipline)
  • Extra Documents:
  • docs/extra-docs/landing-page-attack-scenarios.md -- Red Team: 7 attack chains, full platform takeover, 16-fix hardening roadmap
  • docs/extra-docs/landing-page-adrs.md -- 5 ADRs: caching migration, HTML sanitization, CTA wiring, SEO infrastructure, CI pipeline
  • docs/extra-docs/landing-page-pre-mortem.md -- 9 failure scenarios, ship-blocker list, 3-hour fix estimate for all blockers
  • docs/extra-docs/landing-page-root-cause-analysis.md -- 5 Whys: 6 patterns, 4 systemic root causes, fix-one-fix-many recommendations
  • Key Backend Paths:
  • saas-boilerplate/src/app/modules/v1/Public/ (3 files)
  • saas-boilerplate/src/app/modules/v1/Blog/ (3 files)
  • saas-boilerplate/src/app/modules/v1/GenericPage/ (3 files)
  • saas-boilerplate/src/app/modules/v1/Setting/ (3 files)
  • saas-boilerplate/src/app/modules/v1/Contact/ (3 files)
  • saas-boilerplate/src/app/modules/v1/MenuBuilder/ (Menu + MenuItem, 6 files)
  • saas-boilerplate/src/entity/ (12 entities: Blog, BlogCategory, BlogTags, BlogView, GenericPage, Setting, AppConfig, ContactMessage, Menu, MenuItem, User)
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/app/(main-layout)/ (7 route pages + layout)
  • Sass-boilerplate-frontend-v1/src/components/pages/landing-page/ (7 sections + 2 buttons)
  • Sass-boilerplate-frontend-v1/src/components/pages/blogs/ (blog-card, blog-page-frontend)
  • Sass-boilerplate-frontend-v1/src/components/pages/contact-frontend/ (2 files)
  • Sass-boilerplate-frontend-v1/src/components/pages/dynamic-page/ (1 file)
  • Sass-boilerplate-frontend-v1/src/api/public/ (4 files: blogs, settings, dynamic-page, navigation-links)
  • Sass-boilerplate-frontend-v1/src/components/layout/ (7 files)
  • Sass-boilerplate-frontend-v1/src/constants/landing-page-data.js
  • Key Findings:
  • ALL 5 unstable_cache wrappers use static cache keys ignoring parameters -- page 2 returns page 1 data, blog A shows blog B, footer shows navbar links, contact page shows site settings, Terms page shows About content
  • 2 stored XSS vectors via dangerouslySetInnerHTML (blog content + dynamic page content) with zero sanitization
  • All 7 landing page CTA buttons are completely non-functional (no href, no onClick)
  • Homepage has zero SEO metadata; 3 additional pages also missing metadata
  • Blog view count trivially manipulable (no rate limiting, no dedup)
  • API error responses fall through to .json() crashing entire page tree; no error boundaries exist
  • Zero test coverage on entire public site (0% statements, branches, functions, lines)
  • Ship-blocker fix estimate: ~3 hours for 9 critical items

15. UI Component Library

  • Status: DONE
  • Date: 2026-02-25 | Validated: 2026-02-25
  • Output: docs/deep-dive-ui-component-library.md
  • Scope: Full frontend component system: ui/ (40 shadcn/Radix primitives), custom/ (34 composed application components), editor/ (15 BlockNote files), layout/ (9 header/footer shells)
  • Files Analyzed: 98 (40 ui/ + 34 custom/ + 15 editor/ + 9 layout/)
  • LOC Scanned: ~13,700
  • Known Issues Found: ~405 (9 Critical, 40 High, ~160 Medium, ~200 Low)
  • Dead Code Files: 18 (confirmed never imported, ~2,400 LOC removable)
  • Priority: Medium
  • Key Backend Paths: N/A (frontend-only deep-dive)
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/components/ui/ (40 files)
  • Sass-boilerplate-frontend-v1/src/components/custom/ (34 files)
  • Sass-boilerplate-frontend-v1/src/components/editor/ (15 files, 14 JSX + 1 CSS)
  • Sass-boilerplate-frontend-v1/src/components/layout/ (9 files)
  • Sass-boilerplate-frontend-v1/src/app/globals.css (Tailwind v4 theme config)
  • Sass-boilerplate-frontend-v1/src/lib/utils.js (cn, formatText, generateAvatar)
  • Key Findings:
  • gold color tokens (text-gold, bg-gold, border-gold) are COMPLETELY UNDEFINED in Tailwind config — 16 uses across 7 files silently fail
  • text-light-50 CSS var exists but missing @theme inline mapping — 15 uses across 10 files silently fail
  • 3 competing modal implementations: custom/modal (32 consumers, zero a11y) vs ui/dialog (5 consumers, full a11y) vs ui/alert-dialog (0 consumers, never used)
  • CustomToolbar.jsx hooks called after conditional return — violates React Rules of Hooks, will crash
  • custom/input.jsx switch fallthrough bug — "small" size completely broken (h-0 makes input invisible)
  • IframeEmbed.jsx XSS risk — user URLs embedded as iframe src without sanitization
  • permission-wrapper.jsx calls router.push() during render phase (React anti-pattern)
  • Two Button components coexist (ui/button vs custom/button) used interchangeably with no convention
  • advance-table.jsx and data-table.jsx are 90% duplicate code
  • 5 user flows traced: Login, Dashboard, Blog Create, RBAC, Landing Page — all show component inconsistency
  • "Get Started" buttons on landing page and header have no click handler — completely non-functional
  • Dashboard WelcomeSection references "Total Games" — gaming template remnant
  • Blog create page has triple nested PermissionWrapper for same permission
  • Verification: Tailwind config tokens verified against globals.css, 5 user flows traced end-to-end, modal/dialog consumer audit completed, all critical bugs verified in actual source code

16. Frontend Infrastructure

  • Status: DONE
  • Date: 2026-03-26 | Validated: 2026-03-26
  • Output: docs/deep-dive-frontend-infrastructure.md
  • Scope: Cross-cutting frontend wiring: Redux store (3 files), Axios interceptor (1), custom hooks (10), providers (5), context (1), lib utilities (10), services (3), server actions (2), HOCs (1), constants (3), middleware (1), root layout + 3 app layouts (4)
  • Files Analyzed: 45 (41 core infra + 4 app router layouts)
  • LOC Scanned: ~2,100
  • Known Issues Found: ~179 (16 Critical, 22 High, ~63 Medium, ~62 Low, 8 Systemic)
  • Dead Code Files: 6 confirmed (protected-route.jsx, menuService.js, menuItemService.js, dummyMenuData.js, useMenus.js, useRedux.js — ~727 LOC removable)
  • Priority: Medium (elevated due to 16 Critical issues in auth flow, permissions, and security)
  • Subagent Reports:
  • _bmad-output/extra-docs/redux-state-management-deepdive/ — 29 issues (5C, 8H, 9M, 7L)
  • _bmad-output/extra-docs/custom-hooks-deep-dive/ — 46 issues + 8 systemic
  • _bmad-output/extra-docs/providers-context-infra-deepdive/ — 43 issues (6C, 9H, 12M, 7L)
  • _bmad-output/extra-docs/utils-constants-hocs-actions-deepdive/ — 49 issues (3C, 5H, 16M, 25L)
  • _bmad-output/extra-docs/services-layer-deep-dive/ — 22 issues (4C, 6H, 7M, 5L)
  • _bmad-output/extra-docs/frontend-infra-consumer-analysis/ — 5 user flows traced, 8 cross-cutting findings
  • Key Frontend Paths:
  • Sass-boilerplate-frontend-v1/src/store/ (3 files: index.js, slices/authSlice.js, slices/settingSlice.js)
  • Sass-boilerplate-frontend-v1/src/interceptors/axiosInstance.js
  • Sass-boilerplate-frontend-v1/src/hooks/ (10 files)
  • Sass-boilerplate-frontend-v1/src/components/providers/ (5 files)
  • Sass-boilerplate-frontend-v1/src/context/theme-context.jsx
  • Sass-boilerplate-frontend-v1/src/lib/ (10 files)
  • Sass-boilerplate-frontend-v1/src/services/ (3 files)
  • Sass-boilerplate-frontend-v1/src/actions/ (2 files)
  • Sass-boilerplate-frontend-v1/src/hocs/createIcon.js
  • Sass-boilerplate-frontend-v1/src/constants/ (3 files)
  • Sass-boilerplate-frontend-v1/src/middleware.js
  • Sass-boilerplate-frontend-v1/src/app/layout.js + 3 group layouts
  • Key Findings:
  • No token refresh mechanism — 401 immediately logs out, useRefreshToken hook exists but has zero consumers, and the API doesn't even send a refresh token
  • Permission split-brain after page refresh: Redux user=null while React Query has profile data, all permission checks fail
  • 403 responses trigger full logout instead of showing "Access Denied"
  • middleware.js only checks cookie existence, not JWT validity — token=anything passes
  • protected-route.jsx is 100% dead code (never imported)
  • Theme desync between next-themes and custom ThemeContext (one-way CustomEvent bridge breaks post-mount)
  • uploadFile.js has zero file validation and bypasses auth (no axiosInstance)
  • import * as LucideIcons dumps ~1,000 icons into bundle (~hundreds KB)
  • 4 coexisting state systems (Redux, React Query, Context, localStorage) with weak coordination
  • Settings triple-cached (ISR 24h, React Query 1h, Redux on mount) — can desync
  • settingSlice.js discovery: NOT in original tracker — found by discovery agent
  • 5 user flows traced end-to-end (bootstrap, login→dashboard, permission check, theme switch, data fetching)

For maximum value, deep-dive in this order:

Order Area Files Rationale
1 Authentication System 70+ DONE
2 Subscription & Payments (#2) 48 DONE — 47 issues found
3 User Management & RBAC (#4) 80+ DONE — 68 issues found
4 Email Template System (#6) 44 DONE — 60 issues found, SQL injection + stored XSS chains
5 Middleware & API Infra (#9) 19 DONE — 26 issues found
6 Blog/CMS System (#3) 79 DONE — 236 issues (post-review), 26 Critical incl. SQL injection via orderBy, Rules of Hooks crash
7 Menu Builder (#7) 38+ DONE — 42 issues found, 3,300+ LOC dead code
8 UI Component Library (#15) 98 DONE — ~405 issues found, 18 dead code files, 9 Critical
9 Frontend Infrastructure (#16) 45 DONE — ~179 issues found (16C, 22H), 727 LOC dead code, 5 user flows traced
10 Shared Utilities (#10c) 15 DONE — 108 issues found (17C), pick.ts dead code, privilege escalation via mutable Set
11 Service Factories (#10b) 45+ DONE — ~147 issues found (28C, 33H), ~434 LOC dead code, 11% factory adoption, 13 competing systems
12 Helper Functions (#10a) 33 DONE — 88 issues found (20C, 23H), ~350 LOC dead code, leaked Cloudinary creds, 3x path traversal
13 Logging & Analytics (#13) 34 DONE — 64 issues found (9C), httpLogger dead, no perm check, 3 FE-BE mismatches, ~2,345 LOC dead code
13 Settings & Configuration (#12) 40+ DONE — 85 issues found, 18 Critical (2FA secret leakage, public endpoints, unseeded perms)
14 Landing Page & Public Site (#14) 81 DONE -- 70 issues found (45 + 25 Expert Panel), 5x broken cache + 2x XSS + dead CTAs + GenericPage data leak
15 Product Catalog (#5) 23 DONE — 75 issues found (18C, 19H), ~577 LOC dead code, entire frontend mocked, copy-paste bugs from Blog
16+ Remaining (#8, #11) varies Lower priority, scope as needed

Notes

  • Overlap: Some files appear in multiple deep-dive scopes. The tracker notes overlaps and "Already Covered" files per area.
  • Event System (#11): 11 of 13 files already covered in Auth DD. Consider folding remaining 2 into Payments (#2) deep-dive.
  • Custom deep-dives: You can always specify a custom folder path, file path, or feature name instead of these predefined areas.
  • Validation: Each deep-dive should be validated against actual source code after generation.
  • File counts are verified against actual codebase as of 2026-02-13 (not estimates).
  • Filename typos found: sequrity.ts (middleware), subscribtionExpire.ts (cron), resetSubscribtionStatus.handler.ts (events), LocalSotrage.ts (storage), email-temlate-form.jsx (email-templates-v1).

Maintained alongside the BMAD document-project workflow | Verified 2026-04-11 | Last deep-dive: Logging & Analytics 2026-04-11