ponytail-audit

From README

Map first Audit what the user names: a folder, a package, or the whole repo. Nothing named: the whole repo. Read the README, the deploy and build config, the dependency list, the entry points (main, routes, handlers, jobs, CLI commands) and the tests. Find the expected load: one person running a script, or many users and processes at once. Judge scale against that, and say which load you assumed. Trace the main flows end to end: where data comes in, what is stored, what goes out. Read those paths fully: input from users, money, auth, data writes, background jobs, anything shared between processes. Big repo: go deep where a mistake costs the most, not file by file. Say which parts you did not read. Look for Bug: wrong result, crash, missed edge case (empty, zero, last item, rounding, time zones), callers that disagree with what a function returns, the same rule applied differently in two places.