Code audit services that show what to fix first.
A fixed-scope code audit for apps built with AI, inherited from someone else or left half-finished. You get a written report that tells you what is broken, what is risky and what to fix first.
Audit: US$399 fixed · written report in 3 business days · credited in full to the fix.
Six areas, each with a verdict and a fix list.
Security
Security basics
Exposed keys and secrets, unchecked inputs, weak access control, outdated dependencies with known problems.
Architecture
How it is put together
Structure, duplicated logic and the choices that will make every future change slower or riskier.
Data
Database and data handling
Schema, migrations, backups and how personal or payment data is stored and moved.
Quality
Tests and maintainability
What is tested, what is not, and how hard the code is for a new developer to read and change safely.
Performance
Speed and running cost
The queries, pages and services that make the app slow or expensive, and which fixes matter most.
Deploy
Deployment and operations
How it is released, where secrets live, monitoring, and how recoverable it is if something fails.
What the audit report looks like.
A written document you can read in one sitting and hand to any developer. Every finding says where it is, how serious it is and what to do about it.
- 1. Summary
- One page: the overall verdict, the few findings that matter most, and what to do first.
- 2. Verdict per area
- For each of the six areas: keep it, fix it in place, or rebuild that part, with the reason in a sentence.
- 3. Findings
- Each finding names the file or area it affects, what we saw, why it matters, and the fix we recommend.
- 4. Fix list
- All findings in one prioritized order, so a developer can start at the top.
- 5. What we did not cover
- The limits of the review, so nobody reads silence as a clean bill of health.
See a real one, from an audit of our own site: sample code audit report.
How we rate each finding.
- Critical
- Could expose customer data, lose money or take the product down. Fix before anything else.
- High
- A serious weakness that real use will trigger. Fix before launch or before you add more users.
- Medium
- Makes the code slower to change or more fragile. Fix in the next round of work.
- Low
- Housekeeping and tidy-ups. Worth knowing, no urgency.
Who a code audit is for, and who it is not for.
A good fit
- You built an app with AI tools and want to know whether it is safe to launch
- You bought or inherited a codebase and nobody can explain it
- A developer or agency left, and you need an independent read on what they delivered
- You want a second opinion before spending more on the same code
Not what you need
- A penetration test, compliance certificate or legal opinion: the audit is a code and configuration review, not those
- Ongoing monitoring of a live site: that is a different service from a point-in-time report
- An estimate for something we have not read: we need repository access before we can say anything useful
- Technical SEO for a website: see our technical SEO services instead
If the project has stalled rather than just needing a check, software project rescue covers the takeover and the finish.
The low-risk first step.
Free review
Send the repo or app link. Within 1 business day we reply in writing, with no sales call, to confirm what the audit would cover, what we need from you and the turnaround for your codebase.
Fixed-scope audit
US$399 fixed for one app and one repository, confirmed in writing before we start. We read the code and run the app, then write the report in 3 business days.
Written report
You receive a report with findings ranked by risk and a prioritized list of fixes in plain language. Use it yourself, give it to another developer, or have us do the fixes against a fixed quote.
Ask for an audit of your code.
Tell us what the app does and what worries you. We confirm the scope in writing, then the report follows in 3 business days.
One audit, one price, a report in three days.
US$399
Fixed, for one app and one repository.
300+ web and software projects delivered since 2019.
- Turnaround
- Written report in 3 business days after we have access
- If you go ahead
- The full US$399 is credited to the fix if you book it within 30 days
- Payment
- Pay by card online, or ask first. If the app turns out to be more than one app and one repository, we refund in full before starting
What the audit includes
- We read the repository and run the app, not only the code
- A written report: findings ranked by risk, each tied to the file or area it affects
- A prioritized fix list you can hand to any developer
- A clear verdict for each area: keep it, fix it in place, or rebuild that part
Unusually large codebase, or several services? Ask first and you get a fixed quote before you pay. If you already paid and it turns out larger, we refund in full before starting.
After the audit
Launch rescue in 10 business days
US$4,950
US$4,551 once your US$399 audit is credited (book within 30 days of the report)
Fixed, for one app and one repository, after the US$399 audit.
The launch list from your audit report, working end to end and deployed to your production web host or a mobile store test track, within 10 business days of your written sign-off on the list.
- Turnaround
- 10 business days from your written sign-off on the launch list
- Price
- Fixed for the agreed list, so it never grows. If launch slips past the date through our fault, US$399 comes off
- Payment
- Pay the US$4,551 balance in full, or in two payments of US$2,276 at sign-off and US$2,275 on business day 5
- Not counted
- Time spent waiting in third-party API, KYC and app store review queues
- Bigger jobs
- If the audit shows more than 10 business days of work, you get a fixed quote with its own schedule instead
Book the US$399 audit first. Once you sign off the launch list from the report, we send your US$4,551 launch rescue payment link.
A report you can act on, with no obligation to hire us.
- A written report, not a slide deck or a call you have to remember
- Findings ranked by risk, each with the file or area it relates to
- A prioritized fix list you can hand to any developer
- A direct answer on whether to fix in place, rebuild a part or leave it
- The option of a fixed quote to do the fixes, if you want us to
Founders, buyers and teams in the US, UK, EU and Australia.
Common reasons: an AI-built app before launch, code inherited in an acquisition, a project a previous developer left, or a second opinion before you spend more.
Only need PHP or Node.js moved to a patched, supported version? The US$499 PHP and Node.js upgrade covers one site or app, tested on staging first.
Want to see what we have built? Browse our selected work.
Based in the UK? Code audit services for UK teams explains where the audit fits with UK GDPR, Cyber Essentials and due diligence.
What we have delivered since 2019.
These are totals from Acefina’s delivery record under Rai Ansar, a developer and DevOps engineer since May 2019. We do not list client names. The site counts run higher than the project count because one project often covers several sites.
Questions we get before people start.
What does the audit cover?
Security basics, architecture, database and data handling, tests and maintainability, performance and running cost, and deployment. If you want a narrower look, for example only security, we scope it that way.
What do we have to provide?
Read access to the repository and, if possible, a running copy of the app or a staging link. Environment secrets are not needed; we do not ask for production credentials.
How long does it take, and what does it cost?
US$399 for one app and one repository, with the written report in 3 business days after we have access. If your codebase is unusually large or spans several services, ask first and we quote it before you pay. If you already paid and it turns out larger, we refund in full before starting.
Do you fix the issues too?
Only if you want us to. The report stands on its own. If its launch list fits in 10 business days, we can finish it as a launch rescue for US$4,950 fixed, or US$4,551 after the audit credit. Bigger fixes get a separate fixed quote, with the US$399 credited if you go ahead within 30 days. You can also take the report to someone else.
Will you sign an NDA?
Yes. Send us yours before you share the repository, or ask and we will send ours.
Can you audit AI-generated code?
Yes. The audit looks at the same areas, with extra attention to access control, exposed keys and the data model.
What usually goes wrong in code written by AI tools?
The same few things come up: endpoints that check who you are but not what you may see, keys and secrets left in the front end or the repository, inputs that are not validated, a database with no migrations or backups, duplicated logic that drifts apart, and no tests for anything beyond the happy path. The audit checks each of them.
Is a code audit enough before I launch an AI-built app?
It tells you what is wrong in the code and in how it is deployed, and in what order to fix it. It is a point-in-time review, not a guarantee that the app is free of vulnerabilities or a substitute for a penetration test.
Do you need to see my production data or credentials?
No. We need read access to the repository and ideally a staging or demo copy of the app. Do not send production passwords or secrets.
What does a code audit report contain?
A summary and verdict, a keep-fix-rebuild call for each area, findings with severity (critical, high, medium or low) and the file or area affected, a prioritized fix list, and a note of what the review did not cover.
Get the facts before you spend more.
US$399 fixed. Written report in 3 business days. No obligation to continue.