Technical Debt Audit: How We Found 47 High-Risk Modules in 20 Minutes

FlowSquad's quality risk analysis scores every module for test density, complexity, and security risk — giving you a prioritised refactoring roadmap in minutes, not weeks.

What Is Quality Risk in Practice?

Technical debt is often discussed as a single monolithic problem, but in practice it's a portfolio of risks with very different profiles. A 5-year-old module that nobody has touched in 3 years and that handles a stable, well-understood process is technically "debt" — but it poses minimal risk. The dangerous debt is the combination of factors that create fragility:

• High cyclomatic complexity — many branches, conditions, and loops that create combinatorial test coverage gaps
• Low test density — few or no tests, meaning changes to the module have no safety net
• High change frequency — the module is modified frequently (high business criticality, evolving requirements), compounding the risk of the above
• Security findings — open OWASP findings that haven't been addressed
• High coupling — many inbound dependencies, meaning failures cascade widely

A module that scores high on all five dimensions is a ticking clock. FlowSquad's quality risk analysis surfaces these modules by computing a composite risk score across all dimensions for every file in your codebase — automatically, continuously, and without requiring manual audit work from your senior engineers.

What Is the Difference Between Quick Scan and Deep Scan?

FlowSquad offers two scanning modes with different depth-speed tradeoffs:

Quick Scan

• Runtime: 30–90 seconds for most codebases
• Analyses: test density, obvious complexity indicators, known security pattern matches
• Use case: PR gate checks, pre-commit hooks, daily health checks
• Output: module-level risk flags, HIGH/MEDIUM/LOW classification

Deep Scan

• Runtime: 4–20 minutes depending on codebase size
• Analyses: full cyclomatic complexity calculation, inter-module coupling analysis, data flow analysis for security, branch coverage estimation, change history correlation (from git log)
• Use case: weekly or sprint-start health reports, pre-release risk assessment, architecture review preparation
• Output: composite risk scores per module, ranked remediation list, Jira-ready task descriptions

Most teams run Quick Scan as a CI gate and Deep Scan on a weekly schedule, with an additional Deep Scan before major releases. The combination provides continuous coverage without the overhead of running a full analysis on every commit.

How Does FlowSquad Measure Cyclomatic Complexity?

Cyclomatic complexity (McCabe complexity) measures the number of linearly independent paths through a function's source code. Each conditional branch (if, else if, while, for, catch, case) adds one to the complexity count. A function with a complexity of 1 has a single execution path; a complexity of 15 means there are 15 independent paths that each need to be tested.

FlowSquad calculates cyclomatic complexity at three granularities:

1. Function-level: individual function complexity scores
2. Module-level: aggregate and maximum complexity per file
3. Class-level: average and maximum complexity across a class's methods

FlowSquad's risk scoring weights cyclomatic complexity most heavily when combined with low test density — a complexity-30 function with 90% test coverage is manageable; the same function with 0% test coverage is a critical risk.

How Do You Build a Remediation Sprint from FlowSquad's Output?

FlowSquad's Deep Scan output is designed to translate directly into actionable sprint work — not just a PDF report that sits in a shared drive. The workflow:

1. Run Deep Scan — produces a ranked module list with composite risk scores
2. Review the top 20% of high-risk modules — FlowSquad shows risk score, contributing factors, and an LLM-generated summary of what the module does and why it's risky
3. Select modules for the remediation sprint — choose based on risk score and estimated remediation effort (also provided by FlowSquad)
4. One-click Jira ticket creation — FlowSquad creates Jira tasks for each selected module with: risk score, contributing factors, suggested refactoring approach, test generation task, and security finding links
5. Use FlowSquad's test generation to produce initial test coverage for untested high-risk modules before refactoring begins

# Example: FlowSquad Deep Scan risk report (JSON excerpt)
{
  "scan_id": "dscan-20260226-001",
  "codebase_stats": {
    "total_files": 847,
    "total_loc": 341200,
    "scan_duration_seconds": 1124
  },
  "high_risk_modules": [
    {
      "file": "billing/invoice_processor.py",
      "risk_score": 91,
      "factors": {
        "cyclomatic_complexity_max": 47,
        "test_density": 0.08,
        "security_findings": 2,
        "change_frequency_30d": 14,
        "inbound_dependencies": 23
      },
      "summary": "Core billing module with no meaningful test coverage, SQL injection risk on line 203, and 14 changes in the last 30 days. Highest-priority remediation target.",
      "estimated_remediation_hours": 24,
      "suggested_jira_label": "tech-debt-critical"
    }
  ]
}

What Does a Risk Report Actually Look Like?

FlowSquad's Deep Scan risk report is available in three formats: an interactive dashboard in the FlowSquad UI, a downloadable PDF for engineering leadership, and a JSON/CSV export for custom tooling. The report includes:

• Executive summary — overall codebase health score (0–100), trend vs. previous scan, number of CRITICAL/HIGH/MEDIUM/LOW risk modules
• Module heat map — visual representation of risk density across the codebase directory structure
• Top 20 riskiest modules — ranked by composite score with per-factor breakdowns
• Language-specific insights — complexity and coverage trends per language in polyglot codebases
• Remediation roadmap — estimated hours to bring all HIGH+ risk modules to MEDIUM, enabling capacity planning