Full Project Audit Report — February 2026
Healthcare diagnostics administration platform built with Laravel 11
Functioning multi-tenant healthcare admin platform with real integrations (Twilio, SendGrid, AWS S3, Google Translate, Postalytics). Deployed to production on AWS.
Replacement cost: $300K – $500K
The project has virtually no automated tests — 5 test files, 4 are scaffolding stubs, 1 real test. For a healthcare platform, this is a critical gap.
Delivery Maturity: Low-to-Medium
18 months of development: Aug 2024 – Feb 2026
Laravel setup, Admin module, auth, DB schema, geographic seed data
42 commitsLogin, CRUD pages, messaging, media, accounts, roles, users
367 commitsSettings, products, bundles, global configuration, support entities
382 commitsDocument module (Vue 3 SPA), shared docs, OTP verification, permissions
822 commitsDocument encryption, field mappings, networks, direct mail, triggers
206 commitsEducation flows, communication system, Postalytics, templates
317 commitsFinance dashboard, order forms, global search (declining velocity)
50 commits~15-18 unique contributors, 5-7 core active developers
Top 3 identities account for 65% of all commits.
| Identity | Commits | Share |
|---|---|---|
| "design" account | 884 | 33.9% |
| Danish Saleem | 426 | 16.3% |
| "laraveldiagnostic" (shared) | 394 | 15.1% |
| File | Changes | Risk |
|---|---|---|
resources/assets/js/app.js | 217 | HIGH |
resources/lang/translations.json | 198 | MEDIUM |
Modules/Document/.../DocumentList.vue | 93 | HIGH |
Modules/Admin/routes/web.php | 89 | HIGH |
Modules/Admin/.../navigation.blade.php | 77 | MEDIUM |
.../GlobalSettingsRepository.php | 72 | HIGH |
app/Services/TranslationService.php | 68 | HIGH |
Base estimate: ~7 person-months / ~9,200 person-hours
| Scenario | LOC/dev/day | Person-Months | Cost Range |
|---|---|---|---|
| LOW Senior team, high reuse | 100 | ~4.6 | $230K – $323K |
| BASE Mid-level team, typical | 70 | ~6.6 | $323K – $452K |
| HIGH Junior team, learning curve | 50 | ~9.2 | $461K – $645K |
Modular Laravel 11 application with repository + service patterns
2 self-contained modules via nwidart/laravel-modules
Accounts, users, roles, messaging, products, settings, direct mail, education
Vue 3 SPA, file upload/S3, folders, permissions, shared docs, OTP verification
106 migrations, key patterns:
account_id FK| Module | Description | Integrations | Maturity |
|---|---|---|---|
| Account Management | Multi-tenant CRUD, portal & ecommerce settings | — | High |
| User & Role Mgmt | User CRUD, address management, Spatie RBAC | Spatie | High |
| Messaging System | Templates, sets, communication types | Twilio, SendGrid | High |
| Document Mgmt | Vue 3 SPA, S3, OTP sharing, retention | AWS S3 | High |
| Products & Bundles | Product definitions, bundling, media | — | Medium |
| Translation System | DB-backed i18n, auto-translate, overrides | Google Translate | Medium |
| Direct Mail | Triggers, timing, postage types | Postalytics | Early |
| Education Flows | Screen configs, purpose flows | — | Early |
| Case Notes | Healthcare case note management | — | Early |
| Telemedicine | Provider settings | — | Early |
| Field Mapping | Categories, IDs, mapping types, networks | External | Early |
Maintainability: 4/10 — CI/CD Maturity: 3/10
| Metric | Value |
|---|---|
| Total test files | 5 |
| Real test files | 1 |
| Scaffold/stub tests | 4 |
| Test framework | PHPUnit 10 |
app.js changed 217 times
All admin routes in web.php (89 changes)
3+ shared accounts obscure authorship
16+ consecutive "update" commits
.sass-cache in gitBuild artifacts committed to repository
OWASP Top 10 mapping for the application
.env committedOnly .env.example found
Jenkins uses AWS Secrets Manager
ENCRYPTION_KEY as env var
Key written to disk during deploy
Includes: Twilio SDK, SendGrid SDK, Google Cloud Translate
No automated dependency vulnerability scanning beyond SonarQube.
Key findings from the audit
Clean separation via nwidart/laravel-modules
Consistent repository + service pattern
Hashids, Sanctum, Spatie RBAC, activity logging
Twilio, SendGrid, S3, Google Translate, Postalytics
Laravel 11, PHP 8.2+, Vue 3, Vite 5
Auto-translation with per-account overrides
Well-designed Vue 3 SPA with API separation
SonarQube with quality gate enforcement
1 real test file in 80K LOC
Changes go directly to production
git pull DeploymentNo atomic deploys, no rollback
Quality gate only checks static analysis
Obscures accountability
16+ consecutive "update" commits
app.js changed 217 times
No APM, structured logging, or metrics
Auth, document sharing, permissions
Clone production target with separate database
php artisan test to Jenkins pipelineRun tests before SonarQube analysis
composer install, npm run build, php artisan migrate
Every developer gets their own identity
Catch issues at dev time
Improve frontend performance
Envoy, Deployer, or Laravel Forge
Telescope, Sentry, or New Relic
Structured roadmap to reduce risk and improve delivery maturity
Eliminate the top delivery risks with minimal effort
| Week | Action | Owner | Budget |
|---|---|---|---|
| 1 | Eliminate shared git accounts; enforce personal identities | DevOps/CTO | $0 |
| 1 | Add .sass-cache to .gitignore | Any dev | $0 |
| 1 | Add php artisan test step to Jenkinsfile | DevOps | 2 hrs |
| 1-2 | Set up staging environment | DevOps | $100-200/mo |
| 2-3 | Write feature tests for authentication flow | Senior dev | 3-4 days |
| 3-4 | Write feature tests for document sharing | Senior dev | 3-4 days |
| 4 | Add PHPStan level 5 + baseline to CI | Senior dev | 1 day |
Improve deployment confidence and developer productivity
| Week | Action | Owner | Budget |
|---|---|---|---|
| 5 | Adopt zero-downtime deployment tool | DevOps | 3-5 days |
| 5-6 | Add database migration step to deploy | DevOps | 1 day |
| 6 | Add npm audit + composer audit to CI | DevOps | 2 hrs |
| 6-7 | Split app.js into page-specific bundles | Frontend dev | 3-5 days |
| 7-8 | Write tests for account management CRUD | Dev team | 1 week |
| 8 | Add Sentry or Telescope for error tracking | DevOps | 1 day + $26/mo |
Prepare for growth and healthcare compliance
| Week | Action | Owner | Budget |
|---|---|---|---|
| 9-10 | Implement rate limiting on auth + API | Senior dev | 2-3 days |
| 10 | Add structured logging + log aggregation | DevOps | 2-3 days |
| 10-11 | Database query optimization | Senior dev | 3-5 days |
| 11-12 | Add API documentation (OpenAPI/Swagger) | Dev | 3-5 days |
| 12 | Implement conventional commits via git hook | DevOps | 1 day |
| 12 | Healthcare compliance gap analysis | CTO | External audit |
| Category | Low | Base | High |
|---|---|---|---|
| Developer time | 6 weeks (1 FTE) | 8 weeks (1 FTE) | 12 weeks (1.5 FTE) |
| Infrastructure | $300/mo | $700/mo | $1,500/mo |
| Tooling | $26/mo | $50/mo | $200/mo |
| External (compliance) | $0 | $2,000 | $5,000 |
| Total 90-day cost | $3K-5K | $8K-12K | $15K-25K |