Code Audit · $1,500 flat
Know exactly what
to fix first.
A senior engineer's read on the software you already run — every risk found, impact-ranked, each with a concrete next step. Broad enough to catch what a week of consulting misses, and every finding verified against your actual code before it reaches you. Delivered in days, not weeks.
Flat fee, no surprises · Often starts sooner than a sprint · NDA-friendly
Who it's for
An audit is the low-risk way to get expert eyes on code you depend on — before it bites you, or before someone else looks under the hood. It fits when…
You inherited a codebase
A contractor left, you acquired an app, or a key engineer moved on — and nobody fully knows what's in there.
You're about to launch or raise
Before a launch, a funding round, or a big customer, you want to know what's actually solid and what's a liability.
You're growing fast
It works today, but you're worried what scaling, hiring, or the next feature will expose in the foundation.
You need due diligence
Buying or investing in a software product and need an independent technical read on what you're getting.
What gets looked at
A full pass over the code and how it fits together — not a checklist run, a judgment call on each area, scaled to your stack:
- Security & auth — injection paths, secret handling, authorization gaps, exposed surfaces, and known-vulnerable dependencies.
- Architecture & coupling — where the structure will fight you as you add people and features, and where it won't.
- Reliability & error handling — the failure modes that turn into 2 a.m. pages, and the ones silently swallowing errors today.
- Performance hotspots — N+1 queries, accidental O(n²), unbounded work, and the paths that fall over under real load.
- Data & schema — integrity risks, migrations waiting to hurt, and modeling choices you'll regret at scale.
- Dependencies & supply chain — outdated, abandoned, or risky packages, and what it takes to get current safely.
- Tests & CI — what's actually covered, what only looks covered, and where a safety net is missing.
Why it's different
Reads the whole thing
An AI fleet I built — the same one the studio runs on — reads across the entire codebase, not just the files a human has time to open in a week. Breadth a single consultant can't match.
Every finding verified
This is the part that matters: each finding is checked against your real code — file, line, and symbol confirmed to exist — by a deterministic gate before it's allowed into the report. No hallucinated bugs. No “the AI made it up.”
A senior signs off
Twenty years of engineering reviews, prioritizes, and stands behind every finding. You're not getting raw model output — you're getting a senior engineer's audit, accelerated.
What you get
- A written report — an executive summary you can forward, then the findings in full.
- Impact-ranked findings — each with its location in the code, why it matters in plain language, and a concrete fix or next step.
- Severity tiers — critical down to nice-to-have, so you know what to do Monday and what can wait.
- A 60-minute readout call — we walk the report together and I answer whatever comes up.
- In days, not weeks — and it's a diagnosis, not a rewrite pitch. If the right answer is “leave it alone,” you'll hear that.
A finding looks like this
Order-detail endpoint trusts the caller's user ID
What: GET /orders/:id loads the order by ID but never checks it belongs to the authenticated user — the userId used for the lookup comes from the request body, not the session.
Impact: Any logged-in user can read any other customer's order, including shipping address and line items, by changing one number. Classic broken-object-level authorization (IDOR).
Fix: Derive userId from the verified session, and scope the query to WHERE id = :id AND user_id = :sessionUserId. ~15 minutes; add a regression test that a user cannot fetch another user's order.
Illustrative example, from a sample codebase — shown to give you the format and depth, not a real client's finding.
Want the whole report? See two real audits we ran end-to-end — one that found & fixed a live command-injection → and one that found & fixed a ReDoS (and rejected two findings that didn't hold up) →. Every finding mechanically verified against the source.
Price & terms
One fixed fee agreed up front — no hourly drift, no scope games. A focused audit can usually start sooner than a sprint or retainer. Your code stays yours, an NDA is welcome before the first call, and nothing you share is ever used to train any AI model. If the audit points to work worth doing, it folds cleanly into a Sprint — but there's no obligation, and no upsell baked into the findings.
Common questions
What do you need from me to start?
Read access to the codebase — a GitHub or GitLab invite, or a zip — and a sentence or two on what worries you most. That's enough to begin. If there's a running environment or docs, great, but they're not required.
What if you don't find anything major?
That's a good outcome you paid very little for. You walk away with documented confidence and a short list of smaller improvements, instead of a vague background worry. The audit is a diagnosis — sometimes the diagnosis is “you're in better shape than you thought.”
Do you fix the issues, or just find them?
The audit finds, prioritizes, and tells you exactly how to fix each item. Doing the fixes is a Sprint — though tiny ones are sometimes folded in, and the readout call covers how to work through the list yourself if you'd rather.
Is my code kept confidential?
Yes. I'm happy to sign your NDA before the first call, your code is never used to train any AI model, and access is removed once the audit is delivered. For projects without an NDA, the engagement agreement still contains a confidentiality clause.
How is this different from a scanner or an AI assistant?
A static-analysis tool flags patterns and drowns you in noise it can't prioritize; an AI assistant will confidently invent bugs that aren't there. This is a senior engineer's prioritized judgment with your business context — and every finding is mechanically verified against your real code before it reaches you, so you're never chasing a ghost.
Book an audit
Find out what's actually under the hood.
Send the repo and the one thing that worries you most. You'll have a senior, verified read on it — and a clear list of what to fix first — in days.