Sixteen things nobody reviews in a diff.

$ little-owl check

🦉 Little Owl

✓ storefront — Next.js · TypeScript
✓ Next.js, React detected
✓ 247 files  — 209 source, 38 test
✓ Git repository — change reviews will work

✓ Read the project             247 files
✓ Mapped how files connect     677 connections
✓ Checked the architecture     3 layers: ui → application → infrastructure
✓ Checked for common problems  79ms

────────────────────────────────────────────────────────

Health   81 / 100   ████████████████░░░░

Your project needs attention.

🔴   1  critical    Fix before your app goes live.
🟠   6  important   Fix soon — this gets more expensive the longer it waits.
🟡  12  minor       Improve when you have time. Nothing is broken.

Start with the 1 critical issue. The rest can wait.

WHERE TO START

🔴 #1  A secret can reach the browser through this component
       src/components/panel/AdminGate.tsx
       Following the imports out of AdminGate.tsx leads to code
       that reads a password or key from your environment — and
       everything on that path is sent to the browser.

🟠 #2  ui imports infrastructure directly
       src/app/panel/config/page.tsx:17
       page.tsx reaches straight past the level directly below
       it and talks to the one after that.

… and 16 more. Run `little-owl check --all` to see every one.

NEXT STEP

  → little-owl explain 1   the full story of the first issue

$ little-owl explain 1

🔴 CRITICAL  issue #1

A secret can reach the browser through this component

What happened
  Following the imports out of AdminGate.tsx leads to code that
  reads a password or key from your environment — and everything
  on that path is sent to the browser.

Why this matters
  Anything a browser runs, a visitor can read. They open developer
  tools, search the page source, and the value is there in plain
  text — no hacking required. If this is a database URL, an API
  key or a service credential, treat it as public from the moment
  the page was deployed.

Where
  src/components/panel/AdminGate.tsx

Related files
  src/lib/auth/session.ts  — links the two together
  src/lib/db/client.ts  — where the problem is

How it connects
  src/components/panel/AdminGate.tsx
     ↓
  src/lib/auth/session.ts
     ↓
  src/lib/db/client.ts

What should happen instead
  Secrets are read only by code that runs on your server. The
  browser receives the result of using them, never the values.

Recommended fix
  Move the work into a server component, a route handler or a
  server action, and pass only the finished result down as props.

How to check it worked
  Build the app and search the generated client files for the
  secret value. It must not appear anywhere.

Next step
  → little-owl fix 1

$ little-owl review

🦉 Little Owl

Looking at what changed…

✓ 12 files changed   +486 -73, 3 areas
  uncommitted changes vs HEAD
✓ Compared with the baseline recorded 2 days ago

Health   89 → 83   ↓ -6

This change introduced something that needs fixing before release.

🔴   1  critical    Fix before your app goes live.
🟠   3  important   Fix soon — this gets more expensive the longer it waits.

✓ 2 earlier issues no longer appear.

WHAT THIS CHANGE INTRODUCED

🔴 #1  Circular dependency across 3 files
       src/services/orders.ts
       Some of your files depend on each other in a loop:
       orders.ts -> users.ts -> auth.ts -> orders.ts.
       Each one needs the other to load first.

… and 2 more. Run `little-owl review --details` to see every one.

NEXT STEP

  → little-owl explain 1   what this issue actually means

$ little-owl dead-code

DEAD CODE

5 candidates — nothing in the project imports them.

MEDIUM CONFIDENCE  (2)

  public/sw.js 158 lines
    ✓ nothing in the project imports it
    ✓ it exports nothing
    ⚠ but dynamic imports could not
      be resolved

LOW CONFIDENCE  (3)

  src/components/Mascot.tsx 23 lines
    ✓ nothing in the project imports it
    ⚠ but it exports 2 names
    ⚠ but dynamic imports could not
      be resolved

Little Owl never deletes anything.

NEXT STEP

  → little-owl explain public/sw.js   why it exists, before you delete it

$ little-owl explain src/lib/auth/actions.ts

CODE ARCHAEOLOGY

src/lib/auth/actions.ts

Evidence: strong

Introduced in 0532b4c (29 days ago).
It has been touched in 11 commits.
4 files import it today.

Commits that explain why

  • fix: getCurrentProfile fell open (f1de4da)
  • fix: superadmin owner settings (874242e)

Maintained by
  A. Rivera (11 commits)

Little Owl only reports what the repository
records. Where the history is silent it says so
rather than guessing at a reason.

NEXT STEP

  → little-owl impact src/lib/auth/actions.ts   what else would a change here touch?