tech-debt-audit

Scope the audit to a specific component, then scan for debt signals like long functions, duplicated code, missing tests, and deprecated dependencies. Use static analysis tools such as SonarQube, ESLint, or Bandit, then categorize findings by security, performance, quality, and scalability.

Prioritize by impact and effort: security vulnerabilities are always P0 regardless of effort, then high-impact low-effort quick wins. Calculate ROI as time saved per month times twelve divided by remediation effort, and prioritize items with ROI above 2.

Static analysis tools like SonarQube, ESLint, and Bandit detect complexity, lint violations, and security issues automatically. Automated findings should be manually verified and categorized, since tools cannot assess business impact or remediation priority.

Estimate remediation in engineering days rather than story points or vague sizes like small, medium, or large. Each debt item should include a specific file location, measurable impact such as page load time or error rate, and a concrete fix description.

Not all debt needs immediate remediation; a good audit includes at least one deferred item. Low-impact debt with high effort, or scalability issues that only matter at much higher traffic, can be deferred until conditions justify the investment.