Code audit services for UK founders, buyers and teams.
A fixed-scope code audit for apps built with AI, inherited in an acquisition or left half-finished by a freelancer or agency. You get a written report that says what is broken, what is risky and what to fix first, with personal data risks called out.
Six areas, each with a verdict and a fix list.
Security
Security basics
Exposed keys and secrets, unchecked inputs, weak access control, outdated dependencies with known problems.
Architecture
How it is put together
Structure, duplicated logic and the choices that will make every future change slower or riskier.
Data
Personal data and the database
Schema, migrations and backups, and where your customers’ personal data is stored, copied and accessed.
Quality
Tests and maintainability
What is tested, what is not, and how hard the code is for a new developer to read and change safely.
Performance
Speed and running costs
The queries, pages and services that make the app slow or expensive, and which fixes matter most.
Deploy
Deployment and operations
How it is released, where secrets live, monitoring, and how recoverable it is if something fails.
What the audit report looks like.
A written document you can read in one sitting and hand to any developer. Every finding says where it is, how serious it is and what to do about it.
- 1. Summary
- One page: the overall verdict, the few findings that matter most, and what to do first.
- 2. Verdict per area
- For each of the six areas: keep it, fix it in place, or rebuild that part, with the reason in a sentence.
- 3. Findings
- Each finding names the file or area it affects, what we saw, why it matters, and the fix we recommend.
- 4. Fix list
- All findings in one prioritised order, so a developer can start at the top.
- 5. What we did not cover
- The limits of the review, so nobody reads silence as a clean bill of health.
See a real one, from an audit of our own site: sample code audit report.
How we rate each finding.
- Critical
- Could expose customer data, lose money or take the product down. Fix before anything else.
- High
- A serious weakness that real use will trigger. Fix before launch or before you add more users.
- Medium
- Makes the code slower to change or more fragile. Fix in the next round of work.
- Low
- Housekeeping and tidy-ups. Worth knowing, no urgency.
Where the audit fits with UK GDPR, Cyber Essentials and due diligence.
UK GDPR
UK GDPR asks you to protect personal data with “appropriate technical and organisational measures” (Article 32). The audit shows where personal data sits in your app, who and what can reach it, and the fixes that lower the risk. It reviews code and configuration only; your policies, contracts and records are outside what it sees.
Cyber Essentials
Cyber Essentials is the UK government-backed certification, built on five technical controls and delivered for the NCSC by IASME, and some government contracts that involve personal or financial data ask for it. Our audit is not a certification and does not replace the assessment.
Technical due diligence
Buying or investing in a UK company? The audit gives you an independent read of its code before completion: what to keep, what to fix and what to rebuild, with the reasons. It sits alongside legal and financial due diligence, not in place of them.
Who a code audit is for, and who it is not for.
A good fit
- You built an app with AI tools and want to know whether it is safe to launch
- You bought or inherited a codebase and nobody can explain it
- A freelancer or agency left, and you need an independent read on what they delivered
- You want a second opinion before spending more on the same code
Not what you need
- A penetration test, a Cyber Essentials certificate or a legal opinion: the audit is a code and configuration review, not those
- Ongoing monitoring of a live site: that is a different service from a point-in-time report
- An estimate for something we have not read: we need repository access before we can say anything useful
If the project has stalled rather than just needing a check, software project rescue for UK teams covers the takeover and the finish.
The low-risk first step.
Free review
Send the repo or app link. Within one UK working day we reply in writing, with no sales call, to confirm what the audit would cover, what we need from you and the turnaround for your codebase.
Fixed-scope audit
US$399 fixed for one app and one repository, charged in US dollars and confirmed in writing before we start. We read the code and run the app, then write the report in 3 working days.
Written report
You receive a report with findings ranked by risk and a prioritised list of fixes in plain English. Use it yourself, give it to another developer, or have us do the fixes against a fixed quote.
Ask for an audit of your code.
Tell us what the app does and what worries you. We confirm the scope in writing, then the report follows in 3 working days.
One audit, one price, a report in three days.
US$399
Fixed, for one app and one repository.
- Turnaround
- Written report in 3 working days after we have access
- If you go ahead
- The full US$399 is credited to the fix if you book it within 30 days
- Payment
- Pay by card online in US dollars (your card provider converts it to pounds), or ask first. If the app turns out to be more than one app and one repository, we refund in full before starting
What the audit includes
- We read the repository and run the app, not only the code
- A written report: findings ranked by risk, each tied to the file or area it affects
- A prioritised fix list you can hand to any developer
- A clear verdict for each area: keep it, fix it in place, or rebuild that part
Unusually large codebase, or several services? Ask first and you get a fixed quote before you pay. If you already paid and it turns out larger, we refund in full before starting.
A report you can act on, with no obligation to hire us.
- A written report, not a slide deck or a call you have to remember
- Findings ranked by risk, each with the file or area it relates to
- Where personal data sits in the app and what can reach it, in one list
- A prioritised fix list you can hand to any developer
- A straight answer on whether to fix in place, rebuild a part or leave it
Founders, acquirers and teams across the UK.
Common reasons: an AI-built app before launch, code inherited in an acquisition or management buyout, a project a freelancer or agency left, or a second opinion before you spend more.
Only need PHP or Node.js moved to a patched, supported version? The US$499 PHP and Node.js upgrade covers one site or app, tested on staging first.
Want to see what we have built? Browse our selected work.
Outside the UK? Code audit services for the US, EU and Australia covers the same audit at the same price.
What we have delivered since 2019.
These are totals from Acefina’s delivery record under Rai Ansar, a developer and DevOps engineer since May 2019. We do not list client names. The site counts run higher than the project count because one project often covers several sites.
Questions we get before people start.
What does the audit cover?
Security basics, architecture, the database and personal data handling, tests and maintainability, performance and running costs, and deployment. If you want a narrower look, for example only security, we scope it that way.
How much does a code audit cost in the UK?
Ours is US$399 fixed for one app and one repository, paid by card in US dollars, so your card provider converts it to pounds. The written report arrives 3 working days after we have access. If the codebase is unusually large or spans several services, ask first and we quote before you pay.
Does the audit make us UK GDPR compliant?
No. It shows where personal data sits in the app, who and what can reach it, and what to fix. Compliance also covers your policies, contracts and records, which a code review does not see. A data protection adviser covers that part.
Is it the same as Cyber Essentials or a penetration test?
No. Cyber Essentials is a certification assessed by a certification body, and a penetration test attacks a running system. The audit reads the code and the configuration and tells you what to fix first.
Do you fix the issues too?
Only if you want us to. The report stands on its own. If you ask, we give a separate fixed quote for the fixes and credit the US$399 to it if you go ahead within 30 days. You can also take the report to someone else.
Will you sign an NDA and a data processing agreement?
Yes. Send your NDA before you share the repository, or ask for ours. The audit needs no production data. If later work touches your customers’ personal data, we can sign a data processing agreement.
Can you audit AI-generated code?
Yes. The audit looks at the same areas, with extra attention to access control, exposed keys and the data model.
Do you need to see my production data or credentials?
No. We need read access to the repository and ideally a staging or demo copy of the app. Do not send production passwords or secrets.
What does a code audit report contain?
A summary and verdict, a keep-fix-rebuild call for each area, findings with severity (critical, high, medium or low) and the file or area affected, a prioritised fix list, and a note of what the review did not cover.
Get the facts before you spend more.
US$399 fixed, charged in US dollars. Written report in 3 working days. No obligation to continue.