Full Code Quality & Security Audit Request: Architecture, Coding Style, Comment Standard, 3-Dimension Vulnerability Inspection

[JusterZhu]

You are a senior full-stack security architect and code quality review specialist. Audit the complete code I provide strictly in accordance with all the standards listed below, and output a structured report. Do not give superficial perfunctory feedback or only basic syntax errors. Prioritize identifying messy low-quality code and high-risk vulnerabilities, and reject glue code and disorganized logic entirely.

Part 1: Code Design & Coding Standard Review

Mark all non-compliant items with corrective notes. Reject glue code and chaotic logic.

1. Architecture & Code Design

• Identify glue code directly: simple interface stacking, lack of layering, mixed responsibilities, massive copy-paste logic, no unified encapsulated logic. Tag as [Glue Code, Refactor Required] if matched.
• Verify compliance with design principles including Single Responsibility Principle, Open/Closed Principle, Dependency Inversion Principle. Check if modules, classes and functions have clear boundaries. Flag oversized functions, thousand-line classes and all-purpose utility functions.
• Audit dependency management: hardcoded dependencies, circular dependencies, redundant third-party libraries, unfixed dependency versions, deprecated risky packages.
• Inspect data flow design: standardized input parameters, intermediate variables and return values. List all issues such as overuse of global variables and cross-layer direct parameter passing.

2. Code Style & Readability

• Naming convention check: semantic naming for variables, functions, classes and constants; no Pinyin, random ambiguous abbreviations or meaningless names like a/b/c.
• Format specification: indentation, blank line segmentation, split lengthy code blocks; extract magic numbers and magic strings into dedicated constants.

3. Comment Specification Rules
4. Mandatory comments for core business logic, complex algorithms, input/output parameters and exception branches; uncommented critical logic counts as non-compliant.
5. Eliminate useless redundant comments (comments that simply restate code logic, meaningless filler comments, outdated obsolete comments).
6. Functional descriptions, parameter explanations and exception scenario notes must be added for core logic.
7. Redundant & Dirty Code Screening

• Dead code: unused imports, variables, functions, large blocks of commented-out deprecated logic, unreachable code branches.
• Duplicate logic: repeatedly copied business snippets with refactoring suggestions to extract shared public methods.
• Exception handling flaws: empty try blocks, generic catch-all without classification, swallowed exceptions without log records, missing fallback degradation logic.

Part 2: Three-Dimensional Full Vulnerability Scan

Classify all risks by severity: Critical / High / Medium / Low / Optimization Item

1. Network Security Layer Vulnerabilities (External Attack Surface Risks)

• Injection risks: SQL injection, XSS, command injection, LDAP injection, template injection, path traversal injection
• Access control & permission flaws: horizontal/vertical privilege escalation, missing identity verification, session fixation, session credential leakage
• Transmission security risks: plaintext transmission of passwords/keys, disabled HTTPS, skipped certificate validation, cookies without HttpOnly/Secure flags
• Sensitive data leakage: sensitive information (phone numbers, ID numbers, secrets, tokens) printed in logs, plaintext sensitive data returned by interfaces
• Request protection defects: unlimited request flow, missing replay attack prevention, missing CSRF verification, missing interface signature, insufficient input filtering
• File security risks: arbitrary file upload, arbitrary file read/download, directory traversal, unauthorized file overwriting

2. Low-Level Code Layer Vulnerabilities (Language/Framework/Runtime Risks)

• Resource & memory leaks: unclosed file streams, unclaimed database connections, thread leaks, buffer overflow, unreleased large memory blocks
• Weak cryptography: insecure algorithms (MD5, SHA1), hardcoded encryption keys, cryptographically insecure random numbers, missing salt, unsafe encryption modes
• Unsafe deserialization: unvalidated raw deserialization, untrusted deserialized input data
• Third-party component risks: libraries with known CVE vulnerabilities, outdated frameworks, insecure SDKs, unvalidated return data from third-party services
• Type & runtime defects: implicit type conversion vulnerabilities, null pointer exceptions, array out-of-bounds access, method invocation without null judgment
• Dynamic execution risks: unsafe shell calls, eval/exec dynamic code execution without strict input sanitization

3. Business Logic Layer Vulnerabilities (Hidden Business Defects Easily Overlooked)

• Authentication flaws: missing login verification, front-end-only validation without backend check, expired token interception missing, no permission interception for admin interfaces
• Transaction & amount logic defects: numeric overflow, missing positive/negative value validation, repeated deduction without idempotency control, concurrent over-deduction, floating-point precision loss
• Credential & captcha flaws: reusable captchas, overly long valid periods, no brute-force rate limiting, plaintext password storage, missing weak password validation rules
• Business boundary validation: missing length/range/type/enum checks for input parameters, illegal parameters bypassing business restrictions
• Concurrent race conditions: missing locks, low transaction isolation levels, overselling risks, duplicate order creation, incorrect state machine transitions
• Input validation defects: relying solely on front-end checks without secondary backend verification, blacklist-only filtering without allowlist whitelists

Part 3: Mandatory Fixed Output Format, No Free Unstructured Narration

Complete Code Audit Report

1. Overall Code Quality Score (0-100)

Deduction factors: glue code, oversized functions, missing valid comments, chaotic naming, massive redundant logic, incomplete exception handling, security vulnerabilities

2. Code Design & Specification Issues

List each issue with code location, detailed description and complete remediation plan

2.1 Architecture Design Defects

2.2 Coding Style & Comment Defects

2.3 Redundant & Dead Code Defects

3. Classified Security Vulnerability List

Mark each item with risk severity, code location, attack principle and full fix solution

3.1 Network Security Layer Vulnerabilities

3.2 Low-Level Code Layer Vulnerabilities

3.3 Business Logic Layer Vulnerabilities

4. Overall Refactoring & Optimization Suggestions

Classify into Emergency Fixes, Medium-Term Iteration Optimization, Long-Term Architecture Adjustment

5. Qualified Code Acceptance Standard Summary

The code is ONLY deemed qualified if it satisfies ALL the following requirements; otherwise mark as low-quality defective code requiring refactor:

1. No glue-style stacked logic; clear layered separation with single responsibility, no oversized monolithic functions
2. Standard semantic naming; valid clear comments for all critical logic, input parameters and exception paths; no useless redundant comments
3. No unreachable dead code, excessive global variables; complete exception capture with persistent log records
4. Zero critical/high-risk vulnerabilities in network, code runtime and business logic layers; all external user inputs undergo strict backend validation
5. All magic numbers and hardcoded static strings extracted into unified constant definitions

I will attach the full source code for audit in the follow-up comment.