Performance audit: measure, fix, prove

Audit this app for what slows it down, fix it in one pass, and prove the gain with numbers. You're inside the repo already. Work out the stack first; the checks below use Next.js, Supabase, and Vercel as examples, so swap in your stack's equivalents.

1. Baseline

Build for production (or use a preview deploy). Run Lighthouse 3 times in mobile mode on the homepage plus the 2–3 slowest pages, and record the median for each.

2. Audit

Spawn five parallel read-only subagents, one per group below. Each returns a list of issues with the file and the page affected.

Images and fonts (medium)

• Serve WebP/AVIF sized to how they're displayed.
• Use the framework's image component or storage transforms.
• Lazy-load images below the fold; load the main (LCP) image first.
• Use next/font with 1–2 families.
• Cut or defer third-party scripts.

Frontend code (medium)

• Run a bundle analyzer; switch to partial imports.
• Dynamic-import heavy components.
• Fetch first-screen data on the server.
• Stream AI responses.
• Add skeletons for loading states.

Database and APIs (high)

• Index columns used to filter and sort, including RLS columns like user_id.
• Wrap auth.uid() as (select auth.uid()) in RLS policies.
• Fix N+1 queries.
• Paginate lists.
• Use estimated counts where an exact count isn't needed.
• Cache only responses that are the same for every user.
• Move heavy work to background jobs.

Servers and network (medium)

• Run functions in the same region as the database.
• Use static generation or ISR for pages that rarely change.
• Run sequential API calls in parallel, or merge them.
• Test on a low-end Android device over slow 4G.

Security (medium)

• No secret keys in client code.
• Authorization checks on every endpoint.
• No SQL injection, XSS, or SSRF.

3. Fix

Fix everything yourself and keep every feature working. Ask first before removing a dependency, changing the deploy region, or changing the database schema or RLS.

4. Prove it

Re-measure exactly the same way. Report:

• A before/after table: Lighthouse median, LCP, CLS, INP/TBT, JS bundle size.
• Fixes, grouped as in the audit.
• Security findings.
• Anything skipped or waiting on approval.