Code audit: when to order one and what you get

Order a code audit when you are about to make a decision about software you do not fully understand: before taking over a project from another supplier, before a larger investment in development, after a security incident or when development has noticeably slowed down. You get a written overview of risks in security, quality, performance and operations, ranked by priority, with a recommendation on what to fix now and what can wait.

We do not run audits to find as many bugs as possible. We run them so you know where you stand and can decide with your eyes open.

As seniors who take over and modify other people's websites, online stores and applications every day, we see that system owners often know nothing about the state of their systems. The code is a black box only the original supplier understands. An audit opens that box and translates its contents into the language of decisions: what it costs, what the risks are and what to do about them.

When a code audit pays off

• You are taking over a project from another supplier. The previous company closed, the developer left or you are switching suppliers. Before paying for new development, it is worth knowing whether the code can be built on.
• You are planning a larger investment. A new module, connections to more systems, expansion to another country. An audit shows whether the foundation is ready or needs tidying first.
• Development has slowed down. Every small change takes weeks and breaks something else. That is usually a sign of technical debt that can be named and paid down.
• There was an incident. A data leak, an outage, suspicious activity. Beyond fixing the problem itself, you need to find out whether there are more places like it.
• You built the application with an AI tool. A vibe-coded prototype works, but before letting customers in you need to know whether it is secure. There is a dedicated service for that, AI code to production.
• You are buying a company or a product. Software is often the biggest asset and at the same time the biggest hidden risk.

What a code audit covers

Area	What we look at
Security	login and permissions, input handling, passwords and keys in code, vulnerable libraries
Code quality	structure, duplication, readability, whether the code can be changed sensibly
Tests	whether they exist, what they cover and whether they run automatically on every change
Performance	slow database queries, unnecessary load, how the system will handle growth
Operations	deployment, backups, monitoring, server and dependency updates
Dependencies	outdated frameworks and libraries that no longer receive security fixes

We tailor the scope to the question you need answered. If you only care about security before launch, we do not need to discuss the aesthetics of the code.

How an audit works with us

1. A short conversation. What the audit should achieve, what decision it should inform and what you already know about the system.
2. Access. We get read access to the repository and, if needed, to documentation and the environment. We sign an NDA as standard.
3. Analysis. AI assistants help us go through a large volume of code quickly and find suspicious spots. Every finding is verified by a senior, so the report has no false alarms.
4. Report. A written output with findings ranked by severity.
5. Walkthrough. On a call we explain what the findings mean and how to proceed.

What you get

The output is not a hundred-page document nobody finishes. You get:

• A one-page summary for management: overall state, biggest risks and a recommendation.
• A list of findings with the exact place in the code, a description of the risk and its severity.
• A recommended plan: what to fix now, what in the coming months and what just needs watching.
• An estimate of the effort for fixes, so you can plan the budget whoever does them.

You do not have to order the fixes from us. The report should be usable by any developer or supplier.

How much a code audit costs

We bill a senior's hours worked, €38 / hour excl. VAT. How many hours an audit takes depends on the size of the system and the question you need answered. Before we start we agree on the scope and you get an hour estimate. If you only need a quick second opinion, you can start with a single hour of consulting. Details in our senior IT consulting service and on the pricing page.

The most common findings

Every system is different, but some findings repeat in almost every audit:

• a framework or PHP version that no longer receives security fixes,
• an admin or API that checks login but not permission to the specific record,
• database or payment gateway passwords directly in the repository,
• backups nobody has ever tried to restore from,
• deployment by manually copying files to the server with no change history.

Most of them can be fixed quickly and cheaply once you know about them. The problem is that until someone names them, nobody fixes them.

How to prepare for an audit

You do not need to prepare anything complicated. Access to the repository helps, as does information on where and how the application runs, and a contact for someone who knows the system, if there is one. If documentation is missing, that is fine; that is a finding too. The more clearly you say what decision you need the audit for, the cheaper and more useful it will be.

What an audit is not

A code audit is not a guarantee that the system has no bugs. It is an expert view of the most significant risks. Nor is it a penetration test, where someone actively tries to break into the system, although for security findings we will recommend where one would make sense. And it is not an evaluation of the developers who wrote the code. All code has a history, deadlines and compromises, and we take them into account.

Auditing AI-written code

More and more often we audit code that was written with the help of AI. The process is the same, but some mistakes show up more often: missing authorisation checks, unsanitised input or libraries that do not exist. More in the article Is AI-written code secure?

Summary

A code audit is cheaper than a decision made blind. It pays off before taking over a project, before an investment, after an incident and whenever development stops moving forward. You get a clear list of risks and a plan, not an academic report.

Need to know the state of your system? Write to us and we will agree on the scope of the audit.