Backend Audit Checklist

Use this checklist to assess the health of a backend system. Each item has a measurable threshold. Items marked ✗ are immediate action items. Items marked ⚠ are improvement opportunities.

Scoring: 1 point per ✓. 0 points per ✗ or ⚠.

• 90–100%: Production-ready
• 70–89%: Some gaps, addressable within one sprint
• 50–69%: Significant technical debt, prioritize this quarter
• <50%: High risk, stop and fix before further feature development

1. API Performance

How to measure:

# k6 load test — generates p50/p99 breakdown
k6 run --vus 50 --duration 60s script.js

# wrk quick benchmark
wrk -t 4 -c 100 -d 30s --latency http://localhost:8080/api/users

2. Database

Quick FK index audit (PostgreSQL):

SELECT
    tc.table_name,
    kcu.column_name,
    ccu.table_name AS foreign_table,
    (SELECT COUNT(*) FROM pg_indexes
     WHERE tablename = tc.table_name
     AND indexdef LIKE '%' || kcu.column_name || '%') AS index_count
FROM information_schema.table_constraints tc
JOIN information_schema.key_column_usage kcu
    ON tc.constraint_name = kcu.constraint_name
JOIN information_schema.referential_constraints rc
    ON tc.constraint_name = rc.constraint_name
JOIN information_schema.constraint_column_usage ccu
    ON ccu.constraint_name = rc.unique_constraint_name
WHERE tc.constraint_type = 'FOREIGN KEY'
HAVING index_count = 0;
-- Results: FK columns with no index → add these indexes

3. Caching

Redis health check:

redis-cli INFO stats | grep -E "keyspace_hits|keyspace_misses|evicted_keys"
redis-cli INFO memory | grep -E "used_memory_human|maxmemory_human"
# hit_rate = keyspace_hits / (keyspace_hits + keyspace_misses)
# Target: > 0.80

4. Connection Management

Pool sizing calculator:

target_pool_size = ceil(peak_rps × avg_query_duration_seconds × 1.3)

Example:
  Peak load: 500 req/s
  Avg query: 15ms = 0.015s
  Safety factor: 1.3
  pool_size = ceil(500 × 0.015 × 1.3) = ceil(9.75) = 10
  Cross-check: DB has 4 cores → 4 × 2 = 8 → take max(10, 8) = 10

5. Observability

Minimum viable metric set (Prometheus):

# Must have these metrics for every HTTP endpoint:
http_requests_total{method, path, status_code}
http_request_duration_seconds{method, path}  # histogram with p50/p99

# Database:
db_queries_total{endpoint}
db_query_duration_seconds  # histogram

# Cache:
cache_hits_total
cache_misses_total
cache_evictions_total

# Connection pool:
db_pool_connections_total{state}  # state: idle, active
db_pool_wait_duration_seconds     # histogram

6. Security

7. Reliability

Circuit breaker threshold guidance:

Open circuit when:
  error_rate > 50% in last 10 seconds AND at least 20 requests
Half-open: allow 1 request through every 30 seconds to test recovery
Close: if 3 consecutive successes in half-open state

8. Scalability

9. Development Practices

Score Summary Template

Team: _______________   Date: _______________   Reviewer: _______________

Section                    Score    Max    %
─────────────────────────────────────────────
1. API Performance         ___      6      ___
2. Database                ___      8      ___
3. Caching                 ___      8      ___
4. Connection Management   ___      10     ___
5. Observability           ___      8      ___
6. Security                ___      10     ___
7. Reliability             ___      8      ___
8. Scalability             ___      8      ___
9. Development Practices   ___      5      ___
─────────────────────────────────────────────
TOTAL                      ___      71     ___  %

Top 3 action items:
1. _______________________________________________
2. _______________________________________________
3. _______________________________________________