The cheapest security work is the work you delete

The single most effective change we make to an inherited codebase is deletion. Unused routes, superseded renderers, endpoints nobody calls - each one is attack surface with no upside.

Publishing is a good example. A system that generates files, writes them to a temporary directory and uploads them has three places to get wrong. Rendering on request has one.

Fewer moving parts, fewer surprises

We audited one project and found two renderers, one of which was dead. The dead one still imported the whole template engine, so it was still being reviewed, still being patched, and still shipping in the image.

Deleting it removed a dependency, a service and about four hundred lines. Nothing broke, because nothing used it.

How to find the dead weight

Search for the symbol, not the file name. A module imported nowhere is easy; a module imported once, by another dead module, is the one that survives indefinitely.

Then check the deployment: if the image no longer contains it, you have finished.