PREVENT REGRESSIONS

Stop shipping regressions on shared code.

Afraid to change shared code because you don't know what else it touches? Trace the real blast radius of any change first — every dependent file, route and page — before you ship it.

Analyze my codebase →See the Impact Simulator

mapnostics.com/repo/acme-platform/impact-simulator

Simulate a Change

What breaks if I remove the authentication middleware?

Simulate

RecentWhat breaks if I remove the authent…Which files depend on the UserServi…Impact of changing the database sch…What happens if I rename the config…

TryRemove auth middlewareUserService dependenciesDatabase schema changeRename config.js

Impact Summary

6 files potentially affected

3 High Risk2 Medium Risk2 Zombies in 1 file

Removing the authentication middleware stops session verification on every protected route. Three pages and two API routes become reachable without a signed-in user, and the server-side Supabase calls behind them either fail or return data the caller is not entitled to. Treat this as a security regression, not a refactor.

Copy summary for GitHub PR Unlock detailed dependency graph — Upgrade to Pro

General Best Practices

Standard checklist — not derived from this analysis

Run full test suite before deploying this change

Review all downstream dependencies before merging

Consider a staged rollout to limit blast radius

Reaches 2 API routes, 3 pages and 1 middleware — externally-triggered code in the blast radius.

Reaches 2 API routes and 3 pagesGET /api/ordersPOST /api/ordersGET /api/customers/[id]/checkout/admin/customersMiddleware does not run for: /api/webhooks/stripe

Writes to 2 tables: orders, sessions · reads customers, invoices

3 of 6 changed source files have tests (50%) — 3 untested.

Depends on 1 undeclared env var: AUTH_SESSION_SECRET — missing from the example env file, so a new deployment may run without it set.

Affected FilesWide blast radius

All (6)HighMediumLow

middleware.tsHigh RiskmiddlewareUntested

src/middleware.ts

Every protected route resolves through this file. Removing it drops the session check for the whole matcher, so the pages and API routes below answer to any caller.

High confidence

Middleware does not run for this route · no auth calls found in this file (absence of evidence, not a verdict)

Reads AUTH_SESSION_SECRET (L14) — undeclared in .env.example

ProtectedRoute.tsxHigh RiskpageUntested

src/components/auth/ProtectedRoute.tsx

route.tsHigh RiskGET /api/orders2 tablesUntested

src/app/api/orders/route.ts

CheckoutStepper.tsxMedium RiskpageUnit only

src/components/checkout/CheckoutStepper.tsx

CustomerDetailDialog.tsxMedium Risk1 table2 zombies

src/components/admin/CustomerDetailDialog.tsx

session-helpers.tsLow Risk1 package1 dead

src/lib/auth/session-helpers.ts

✓

Trace the real dependency graph

Not a guess based on file names or folder structure — the actual import graph, API routes and database writes a change touches.

✓

Catch the untested files first

Every affected file is flagged with its test coverage, so the riskiest part of the change is the part reviewers see first.

✓

A summary you can paste into the PR

One click copies a plain-English impact summary, so a reviewer sees the blast radius before they see the diff.

Trace your first blast radius in under 2 minutes.

Analyze my codebase →

No credit card required · Free tier available

Common questions

How do I know what a code change will break?

Trace the real dependency graph from the file or symbol you're changing — every dependent file, API route and page — before you ship, not after a regression shows up.

How do you avoid regressions when changing shared code?

See the untested dependents first: every affected file is flagged with its test coverage, so the riskiest part of the change is the part reviewers see first.

Can I share a blast radius summary with reviewers?

Yes. One click copies a plain-English impact summary you can paste straight into a pull request.