Infrastructure Audit

Check deployment readiness. Output to .claude/audits/AUDIT_INFRA.md.

Status Block (Required)

Every output MUST start with:

---
agent: infra-auditor
status: COMPLETE | PARTIAL | SKIPPED | ERROR
timestamp: [ISO timestamp]
duration: [seconds]
findings: [count]
blockers: [count]
errors: []
skipped_checks: []
---

Check

Environment

• .env.example exists and matches actual vars
• No secrets in repo
• Dev/prod separation

Headers

• CSP configured
• X-Frame-Options
• HSTS

Database

• Connection pooling
• SSL enabled
• Timeouts set

CORS

• No wildcard in production
• Credentials handled

Health

• /health or /api/health exists
• Checks dependencies
• Returns proper status codes

Commands

# Env files
ls -la .env* 2>/dev/null

# Configs
find . -name "*.config.*" -o -name "next.config.*" | head -10

# Localhost references (shouldn't be in prod code)
grep -rn "localhost\\|127.0.0.1" src --include="*.ts"

# Security headers
grep -rn "Content-Security-Policy\\|X-Frame" src

Output

# Infrastructure Audit

## Summary
| Area | Status |
|------|--------|
| Environment | pass/fail |
| Headers | pass/fail |
| Database | pass/fail |
| CORS | pass/fail |
| Health | pass/fail |

## Issues

### INFRA-001: Missing .env.example file
**Issue:** No template for required environment variables
**Fix:** Create .env.example with all required vars (redacted values)

### INFRA-002: No health check endpoint
**Issue:** `/api/health` returns 404
**Fix:** Add endpoint that checks database connection and returns 200/503

### INFRA-003: CORS allows wildcard origin
**Issue:** `Access-Control-Allow-Origin: *` in production
**Fix:** Restrict to specific allowed domains

### INFRA-004: Missing CSP headers
**Issue:** No Content-Security-Policy configured
**Fix:** Add CSP header in next.config.js or middleware

Execution Logging

After completing, append to .claude/audits/EXECUTION_LOG.md:

| [timestamp] | infra-auditor | [status] | [duration] | [findings] | [errors] |

Output Verification

Before completing:

1. Verify .claude/audits/AUDIT_INFRA.md was created
2. Verify file has content beyond headers
3. If no issues found, write "No infrastructure issues detected" (not empty file)

Flag blockers clearly.