IMPACT SIMULATOR

The change impact analysis tool that shows what breaks before you ship.

Ask what a change affects in plain English and get the real blast radius — every dependent file, API route and page — traced from your actual dependency graph, not a guess.

Analyze my codebase →See how it works

mapnostics.com/repo/acme-platform/impact-simulator

Simulate a Change

What breaks if I remove the authentication middleware?

Simulate

RecentWhat breaks if I remove the authent…Which files depend on the UserServi…Impact of changing the database sch…What happens if I rename the config…

TryRemove auth middlewareUserService dependenciesDatabase schema changeRename config.js

Impact Summary

6 files potentially affected

3 High Risk2 Medium Risk2 Zombies in 1 file

Removing the authentication middleware stops session verification on every protected route. Three pages and two API routes become reachable without a signed-in user, and the server-side Supabase calls behind them either fail or return data the caller is not entitled to. Treat this as a security regression, not a refactor.

Copy summary for GitHub PR Unlock detailed dependency graph — Upgrade to Pro

General Best Practices

Standard checklist — not derived from this analysis

Run full test suite before deploying this change

Review all downstream dependencies before merging

Consider a staged rollout to limit blast radius

Reaches 2 API routes, 3 pages and 1 middleware — externally-triggered code in the blast radius.

Reaches 2 API routes and 3 pagesGET /api/ordersPOST /api/ordersGET /api/customers/[id]/checkout/admin/customersMiddleware does not run for: /api/webhooks/stripe

Writes to 2 tables: orders, sessions · reads customers, invoices

3 of 6 changed source files have tests (50%) — 3 untested.

Depends on 1 undeclared env var: AUTH_SESSION_SECRET — missing from the example env file, so a new deployment may run without it set.

Affected FilesWide blast radius

All (6)HighMediumLow

middleware.tsHigh RiskmiddlewareUntested

src/middleware.ts

Every protected route resolves through this file. Removing it drops the session check for the whole matcher, so the pages and API routes below answer to any caller.

High confidence

Middleware does not run for this route · no auth calls found in this file (absence of evidence, not a verdict)

Reads AUTH_SESSION_SECRET (L14) — undeclared in .env.example

ProtectedRoute.tsxHigh RiskpageUntested

src/components/auth/ProtectedRoute.tsx

route.tsHigh RiskGET /api/orders2 tablesUntested

src/app/api/orders/route.ts

CheckoutStepper.tsxMedium RiskpageUnit only

src/components/checkout/CheckoutStepper.tsx

CustomerDetailDialog.tsxMedium Risk1 table2 zombies

src/components/admin/CustomerDetailDialog.tsx

session-helpers.tsLow Risk1 package1 dead

src/lib/auth/session-helpers.ts

Simulate the blast radius before you push to production

✓

Ask in plain English

Type "what breaks if I remove the auth middleware" and get an answer traced from your real dependency graph, not a keyword search.

✓

Every dependent, ranked by risk

API routes, pages, database writes and untested files — sorted High to Low, with the reasoning behind each severity shown inline.

✓

A summary you can paste into a PR

One click copies a plain-English impact summary, so reviewers see the blast radius before they see the diff.

Trace your first blast radius in under 2 minutes.

Analyze my codebase →

No credit card required · Free tier available

Common questions

What is blast radius analysis?

It is the full set of code a change can affect — every dependent file, API route and page. Mapnostics traces it from your real dependency graph rather than guessing from file or folder names.

How does the Impact Simulator know what a change affects?

It walks the import and call graph outward from the file or symbol you name, following every dependency edge, and ranks the affected files by risk, including their test coverage.

Can I share an impact analysis with my team?

Yes. One click copies a plain-English impact summary you can paste into a pull request, so reviewers see the blast radius before they see the diff.