Code audit services that show what to fix first.
A fixed-scope code audit for apps built with AI, inherited from someone else or left half-finished. You get a written report that tells you what is broken, what is risky and what to fix first.
Six areas, each with a verdict and a fix list.
Security
Security basics
Exposed keys and secrets, unchecked inputs, weak access control, outdated dependencies with known problems.
Architecture
How it is put together
Structure, duplicated logic and the choices that will make every future change slower or riskier.
Data
Database and data handling
Schema, migrations, backups and how personal or payment data is stored and moved.
Quality
Tests and maintainability
What is tested, what is not, and how hard the code is for a new developer to read and change safely.
Performance
Speed and running cost
The queries, pages and services that make the app slow or expensive, and which fixes matter most.
Deploy
Deployment and operations
How it is released, where secrets live, monitoring, and how recoverable it is if something fails.
What the audit report looks like.
A written document you can read in one sitting and hand to any developer. Every finding says where it is, how serious it is and what to do about it.
- 1. Summary
- One page: the overall verdict, the few findings that matter most, and what to do first.
- 2. Verdict per area
- For each of the six areas: keep it, fix it in place, or rebuild that part, with the reason in a sentence.
- 3. Findings
- Each finding names the file or area it affects, what we saw, why it matters, and the fix we recommend.
- 4. Fix list
- All findings in one prioritised order, so a developer can start at the top.
- 5. What we did not cover
- The limits of the review, so nobody reads silence as a clean bill of health.
See a real one, from an audit of our own site: sample code audit report.
How we rate each finding.
- Critical
- Could expose customer data, lose money or take the product down. Fix before anything else.
- High
- A serious weakness that real use will trigger. Fix before launch or before you add more users.
- Medium
- Makes the code slower to change or more fragile. Fix in the next round of work.
- Low
- Housekeeping and tidy-ups. Worth knowing, no urgency.
Who a code audit is for, and who it is not for.
A good fit
- You built an app with AI tools and want to know whether it is safe to launch
- You bought or inherited a codebase and nobody can explain it
- A developer or agency left, and you need an independent read on what they delivered
- You want a second opinion before spending more on the same code
Not what you need
- A penetration test, compliance certificate or legal opinion: the audit is a code and configuration review, not those
- Ongoing monitoring of a live site: that is a different service from a point-in-time report
- An estimate for something we have not read: we need repository access before we can say anything useful
- Technical SEO for a website: see our technical SEO services instead
If the project has stalled rather than just needing a check, software project rescue covers the takeover and the finish.
The low-risk first step.
Free review
Send the repo or app link. We confirm what the audit would cover, what we need from you and the turnaround for your codebase.
Fixed-scope audit
US$399 fixed for one app and one repository, confirmed in writing before we start. We read the code and run the app, then write the report in 3 business days.
Written report
You receive a report with findings ranked by risk and a prioritised list of fixes in plain language. Use it yourself, give it to another developer, or have us do the fixes against a fixed quote.
Ask for an audit of your code.
Tell us what the app does and what worries you. We confirm the scope in writing, then the report follows in 3 business days.
One audit, one price, a report in three days.
US$399
Fixed, for one app and one repository.
- Turnaround
- Written report in 3 business days after we have access
- If you go ahead
- The full US$399 is credited to the fix if you book it within 30 days
- Payment
- Pay by card online, or ask first. If the app turns out to be more than one app and one repository, we refund in full before starting
What the audit includes
- We read the repository and run the app, not only the code
- A written report: findings ranked by risk, each tied to the file or area it affects
- A prioritised fix list you can hand to any developer
- A clear verdict for each area: keep it, fix it in place, or rebuild that part
Unusually large codebase, or several services? Ask first and you get a fixed quote before you pay. If you already paid and it turns out larger, we refund in full before starting.
A report you can act on, with no obligation to hire us.
- A written report, not a slide deck or a call you have to remember
- Findings ranked by risk, each with the file or area it relates to
- A prioritised fix list you can hand to any developer
- A direct answer on whether to fix in place, rebuild a part or leave it
- The option of a fixed quote to do the fixes, if you want us to
Founders, buyers and teams in the US, UK, EU and Australia.
Common reasons: an AI-built app before launch, code inherited in an acquisition, a project a previous developer left, or a second opinion before you spend more.
Only need PHP or Node.js moved to a patched, supported version? The US$499 PHP and Node.js upgrade covers one site or app, tested on staging first.
Want to see what we have built? Browse our selected work.
Questions we get before people start.
What does the audit cover?
Security basics, architecture, database and data handling, tests and maintainability, performance and running cost, and deployment. If you want a narrower look, for example only security, we scope it that way.
What do we have to provide?
Read access to the repository and, if possible, a running copy of the app or a staging link. Environment secrets are not needed; we do not ask for production credentials.
How long does it take, and what does it cost?
US$399 for one app and one repository, with the written report in 3 business days after we have access. If your codebase is unusually large or spans several services, ask first and we quote it before you pay. If you already paid and it turns out larger, we refund in full before starting.
Do you fix the issues too?
Only if you want us to. The report stands on its own. If you ask, we give a separate fixed quote for the fixes and credit the US$399 to it if you go ahead within 30 days. You can also take the report to someone else.
Will you sign an NDA?
Yes. Send us yours before you share the repository, or ask and we will send ours.
Can you audit AI-generated code?
Yes. The audit looks at the same areas, with extra attention to access control, exposed keys and the data model.
What usually goes wrong in code written by AI tools?
The same few things come up: endpoints that check who you are but not what you may see, keys and secrets left in the front end or the repository, inputs that are not validated, a database with no migrations or backups, duplicated logic that drifts apart, and no tests for anything beyond the happy path. The audit checks each of them.
Is a code audit enough before I launch an AI-built app?
It tells you what is wrong in the code and in how it is deployed, and in what order to fix it. It is a point-in-time review, not a guarantee that the app is free of vulnerabilities or a substitute for a penetration test.
Do you need to see my production data or credentials?
No. We need read access to the repository and ideally a staging or demo copy of the app. Do not send production passwords or secrets.
What does a code audit report contain?
A summary and verdict, a keep-fix-rebuild call for each area, findings with severity (critical, high, medium or low) and the file or area affected, a prioritised fix list, and a note of what the review did not cover.
Get the facts before you spend more.
US$399 fixed. Written report in 3 business days. No obligation to continue.