feature-auditlisted

# SaaS / Multi-User App Audit This skill turns an existing codebase into a prioritized, evidence-based action plan. It looks at two things side by side, because in a multi-tenant SaaS they're tightly coupled — a missing rate limiter is both a security hole and a scalability gap, a missing tenant-scoping check is both a breach risk and a feature gap: 1. **Security & architecture breaches** — things that are actively dangerous or will break under real usage 2. **Missing features for a scalable multi-user product** — things a mature SaaS needs that this codebase doesn't have yet Producing a good report here depends on grounding every claim in something you actually found in the code — file paths, function names, config values. A generic "add rate limiting" bullet is nearly useless to a developer; "no rate limiting found on `/api/*` routes in `src/routes/api.ts` — any endpoint can be hit unbounded" is actionable. Resist the temptation to pattern-match from experience with "typical SaaS problems" without verifying against this specific codebase. ## Workflow ### Step 1: Map the codebase before judging it Don't start checking boxes against a checklist immediately — first understand what you're looking at: - Identify the stack (language, framework, ORM/database, auth library, deployment target). Look at `package.json`/`requirements.txt`/`Gemfile`/etc., config files, and the top-level directory structure. - Identify how "tenant"/"user" boundaries are modeled — is this single-ten