Should this code
go to production?

Catch blocks that contain no statements silently swallow exceptions. Errors disappear and failures become invisible in production logs.

TODO and FIXME comments, and throw new Error('Not implemented') placeholders that indicate unfinished work that was never completed.

Functions named validate*, isValid*, check*, or verify* whose body unconditionally returns true. All input passes. Nothing is validated.

Functions exceeding 80 lines. Functions exceeding 200 lines are flagged at high severity. Long functions are a reliable indicator of generated-and-never-reviewed code.

Control-flow nesting deeper than 4 levels. Deep nesting indicates logic that was generated without applying early-return or extraction patterns.

Cyclomatic complexity exceeding 10. Each unit of complexity is an independent execution path that must be understood and tested.

Statements after return, throw, break, or continue that can never execute. Indicates control-flow errors common in generated code.

API keys, passwords, tokens, and private keys in source files. Detected via pattern matching for AWS keys, GitHub tokens, Stripe keys, database connection strings, and JWT secrets.

SQL queries built with template literals or string concatenation. The most exploited class of web application vulnerability.

exec(), spawn(), and related child_process calls with dynamically constructed first arguments. Shell metacharacters in user input lead to remote code execution.

File system operations with dynamic path arguments. Without validation, ../ sequences allow reading and writing outside the intended directory.

eval() and new Function() execute strings as JavaScript. Any external data in the string is a code injection vector.

Dynamic bracket assignment and unsafe deep-merge operations that may allow an attacker to inject properties into Object.prototype.

Math.random() for security tokens, MD5 and SHA1 hash algorithms, and ECB cipher mode. None of these are cryptographically safe.

Wildcard CORS origins, cookies with httpOnly: false, cookies with secure: false, and sameSite: 'none' without secure: true.

Calls to async APIs whose returned Promise is discarded. Rejection causes a process crash in Node.js 15+ or silent data loss in earlier versions.

Async functions that return an un-awaited Promise. Exceptions thrown by the returned call will not be caught by surrounding try/catch blocks.

while(true) and for(;;) loops without a reachable break, return, or throw. Blocks the Node.js event loop and renders the server unresponsive.

Source files exceeding 400 lines. Large files create merge conflicts, slow code review, and indicate missing module boundaries.

Import patterns that commonly cause circular dependency cycles. Detected via single-file heuristics for barrel re-export patterns.

console.log(), console.debug(), and related debug methods. Leaks internal state, pollutes logs, and may expose sensitive data in aggregation systems.

Localhost URLs, debug flags set to true, and mock function implementations that were never replaced with production code.