Security Audit Removes 16,808 Lines of Unused Production CodeSecurity Audit Removes 16,808 Lines of Unused Production Code
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Shoaib's avatar
Shoaib Vohra
• Oct 19
My best commit this month deleted 16,808 lines.
I ran an end-to-end security audit on Orbit, my finance side project. The worst find: an old backend I had stopped using was still live in production, and it trusted tokens it shouldn't have. Nothing in the app called it anymore, so nobody was looking at it.
What changed: → Deleted the old backend and the unused screens that went with it, so it can't be redeployed → Capped request bodies and kept database and API error text in the logs, not in responses → Locked the database down by default and kept closed periods closed → Added security headers (CSP, frame blocking) and a dedicated security test file
126 files changed, +565 / −16,808 lines.
The PM lesson: unused code isn't harmless. If it's deployed, it's attack surface. "We don't use that anymore" should mean "it's deleted", not "it's ignored".
What dead code is still live in your product?
orbitpay.biz
Post image
Back to feed
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started