# AUDIT SUMMARY – Tables

| Priority | Issue ID | Area | Summary | Status | Next Step |
|----------|----------|------|---------|--------|-----------|
| HIGH | ISSUE-003 | apps/api/src/middleware/auth.middleware.ts | Role precedence between Auth0 token vs Firestore unclear; risk of privilege drift | Open | Define deterministic precedence order + tests |
| HIGH | ISSUE-007 | apps/api/src/core/modules.ts | Module registration lacks guard; single module failure may crash boot silently | Open | Wrap registrations with error handling/fail-fast logging |
| HIGH | ISSUE-101 | apps/api/src/modules/analytics/analytics.service.ts | Funnel conversion/dropoff metrics overstated due to missing intersection logic | Fixed | Run analytics reporting to validate new outputs |
| MEDIUM | ISSUE-001 | apps/api/src/server.ts | Rate limit 2000/min likely too permissive for prod | Fixed | Defaults tightened (300 prod / 1000 dev) + env config + health allowlist |
| MEDIUM | ISSUE-002 | apps/api/src/server.ts | Health endpoints always 200 even if Redis degraded | Fixed | Dependency probe util returns 503 on degraded Redis/Firestore |
| MEDIUM | ISSUE-102 | apps/api/src/modules/analytics/__tests__/analytics.service.spec.ts | Firestore mock lacked select()/in support → analytics tests brittle | Fixed | Keep mock parity when adding new query shapes |
