Globals carry mutable state across request boundaries (auth.go:47 holds a package-level user cache with no eviction). Error handling swallows errors silently in 11 of the 18 functions sampled — `if err != nil { return nil }` with no log, no wrap. Naming is inconsistent within single files.

Cyclical imports between two packages worked around by an interface{} type assertion. README claims '100% test coverage'; actual coverage on the core package is 42% per `go test -cover`. SQL queries built by string concatenation in 3 spots.

Heavy Copilot use without review discipline: 'fix lint' commits in batches of 30+ files at a time, none reviewed. .cursorrules absent. The AI is doing the typing; nobody is doing the thinking.