Memory Wiki

Sweep the entire Profe codebase for gremlins. Write to /root/.hermes/plans/gs-gremlin-report.md. ## What to hunt (implementation-focused) ### Silent Failures - Empty catch blocks `catch (Throwable $e) {}` — errors swallowed - `@SuppressWarnings` or `// ignore` comments that mask real bugs - Functions that return a default value on error (return null/empty array) but caller doesn't check - `trigger_error` or `error_log` that nobody monitors ### Missing State Checks - Null checks missing before method calls (`$user = findByUuid(...)` then `$user->getName()` without null check) - Array key access without `isset()` or `??` — `$data['key']` when key might not exist - Return value of `getResults()` used without checking if it's false or empty - Assumes `$container->get(id)` always returns — no `$container->has(id)` check ### Security Gaps - Routes with `permission_callback => '__return_true'` that access sensitive data - Direct DB queries in Service files instead of Repository layer - User-supplied data used in file paths or SQL without sanitization - IDs from URL params used directly in queries without type validation ### Webhook Vulnerabilities - Webhook handlers that return 200 even when processing failed (Stripe stops retrying) - Webhook handlers missing idempotency checks (same event processed twice) - No payload size limits on webhook endpoints ### Staging vs Production Differences - Hardcoded `test_password_123` or similar defaults - URLs pointing to `localhost` or `staging.` that won't work in production - SSL/TLS assumptions (http:// instead of https://) - Docker-specific paths that won't exist on a real server ### Migration Risks - DDL that will fail on production (different MySQL/MariaDB versions) - `IF NOT EXISTS` on everything — silently skipping means you'd never know a migration didn't run - Seed data that includes test content (fake users, sample data that should be staging-only) ### Missing Tests - Pipeline steps (T44) with no unit tests - Webhook handlers with no integration tests - Modules that have 0 tests despite FAULT-009 requiring ≥12 ## Report format Per finding: - **Category**: Silent Failure / State Check / Security / Webhook / Environment / Migration / Testing - **File**: path + line - **Risk**: LOW / MEDIUM / HIGH / CRITICAL - **Description**: what's wrong - **Fix**: what to do