Code Review Checklist

Architecture

• Request path follows route → handler → service → repository → db
• No business logic in handlers; no raw SQL in services
• Domain index.ts is the only public export

Naming

• Files are kebab-case
• No TPL_ placeholders left over

Security

• No secrets in source code or comments
• NEXT_PUBLIC_* only for browser-safe values
• Webhook signatures verified before processing

IP boundary

• No banned vendor or product-specific terms (see scripts/check-banned-vendor-terms.mjs)
• New packages have SOURCE.md, LICENSE.md, README.md
• MIGRATION_LOG.md updated if code moved from product repo

Tests

• Unit tests co-located with module
• E2E tests only in tests/e2e/
• No testing implementation details