What Should Engineers Include in a Code Audit Checklist?

A few years back I got handed a Node service that three different contractors had taken turns on. No README worth reading, 11 environment variables with no documentation, and a test suite that passed