One command. Five analyzers. One score.
Know exactly what's wrong — before your users do.
codediag auto-detects Node.js, NestJS, Express, and Next.js projects, then applies framework-aware checks.
Inspects NestJS, Express, and Next.js APIs. Checks authentication, validation, documentation, error handling, and health routes.
Finds hardcoded secrets, unsafe .env tracking, open CORS, missing runtime Helmet or rate limiting, and weak password handling.
Runs the matching npm, pnpm, or Yarn audit, then checks lock files, deprecated packages, engine specs, and essential scripts.
Measures line, statement, function, and branch coverage from Istanbul reports, with static test checks as a fallback.
Validates useful README content, inherited lint and format config, resolved TypeScript strict mode, NestJS feature modules, and environment templates.
Turns findings into a prioritized checklist or a structured AI handoff. It never edits files or applies a recommendation without explicit approval.
Publishes findings to Problems and opens local reports, fix plans, and AI review prompts without leaving the editor.
Every analyzer contributes to a weighted total. Security counts most, because shipping vulnerable code is the worst bug.
Add one line to your pipeline. codediag exits with code 1 if the score drops below your threshold.
npx @sabahattink/codediag scan .