A 59-agent audit of an enterprise AEM codebase
After an outage showed how much damage one unguarded call can do, we reviewed two large AEM codebases end to end and turned the findings into fixes and a playbook the team now codes by.
Client
- Enterprise client
- Name withheld
Our role
- Review design and orchestration
- Verification of every finding
- Remediation
Stack
- Java / OSGi
- Sling Models
- AEM as a Cloud Service
- AI-assisted multi-agent review
The question
The outage came from another team’s code. The obvious follow-up was whether our own code had the same weaknesses, and what else had built up over years and several vendors.
The method
An orchestrated, AI-assisted review of both codebases, with a verification pass on every finding before it counted. Three false positives were thrown out. The result was a formal, evidence-backed report the client could act on.
What it found
- Outbound calls with no timeouts, including the same pattern that caused the outage
- Resource leaks in scheduled jobs
- Errors when optional content was missing
- Shared state on services that should be stateless
- A bot-protection check that never actually verified
- Configuration values that belonged in secrets
The playbook
Findings get fixed once; patterns stop them coming back. The team now follows six rules: timeouts on request-time calls, timeouts on job calls, safe resource handling in jobs, defensive content access, defensive component initialization, and the right home for secrets versus settings.
Results
- Critical and high findings fixed and shipped
- Adobe security-report items cleared
- The outage pattern removed from our own code
- A prioritized risk register the client uses for planning
Is your platform telling you something?
An AEM health check is the fastest way to find out what’s fragile before it breaks.
Book a health check