QA & Release Assurance

Code Audit & Review

An independent review of your codebase, whether written by people or generated with AI tools. We find security flaws, fragile design and technical debt, and give you a prioritized plan to fix them.

Discuss your projectDiscuss a code audit

When teams ask for an audit

You have to decide whether to build on a codebase, fix it first or replace parts of it, and nobody independent has read it closely enough to tell you.

  • Teams taking over code from an agency, freelancer or departing developer
  • Investors or buyers who need an independent technical view before a deal
  • Founders hiring their first engineers onto a codebase AI tools largely wrote

What the review looks at

Typical review areas for a web codebase; how deep each goes follows the scope we agree.

  • Architecture & code health

    • Where business rules live and how modules depend on each other
    • Duplicated or contradictory rules across files and services
    • Whether tests on critical rules would fail if the rule broke
    • Error paths: timeouts, retries and what happens when a call fails

  • Security in the source

    • Whether every route, handler and background job checks authorization
    • Untrusted input traced to queries, templates, file paths and shell calls
    • Secrets in code, config files and repository history
    • Personal data leaking into logs, error messages and analytics events

  • Delivery & dependencies

    • Packages nobody chose deliberately, including ones AI tools added
    • Known vulnerabilities, abandoned libraries and license obligations
    • Build, CI and deployment scripts, and how a release is rolled back
    • Database migrations and per-environment configuration

Know what you're building on

You may be inheriting a codebase, facing technical due diligence, preparing a major release, or shipping code produced quickly with AI tools. Each time, you need to know what you're building on. Our engineers review architecture, security, performance, tests and dependencies, and explain every finding with its business risk and a recommended fix. For AI-generated code, we look for the specific problems these tools tend to leave behind, before they reach production.

AI-assisted analysis, engineer-verified findings

How AI assists

  • Maps a large codebase quickly: modules, data flows, entry points and where sensitive data is handled.
  • Runs and triages static analysis, dependency and secret scans, grouping duplicates and likely false positives.
  • Searches the whole codebase for a pattern once it's found, such as a missing authorization check.
  • Drafts finding write-ups and fix examples for engineers to verify and edit.

What our experts own

  • Engineers confirm every finding in context before it goes in the report. Unverified tool output doesn't.
  • Architecture advice weighs your team, roadmap and constraints, not just pattern rules.
  • Severity reflects business impact and exploitability, not a tool's default score.
  • The remediation plan is ordered by risk and effort, with the trade-offs explained.

What you receive

A clear picture of your code and what to fix first

  • Architecture and maintainability

    Structure, coupling, duplication, test coverage of critical logic and documentation gaps, with advice that fits your roadmap, not a default rewrite.

  • Security code review

    Injection, authentication, authorization, secrets handling and input validation, reviewed against OWASP guidance. Only confirmed findings are reported.

  • AI-generated code review

    Checks for duplicated logic, inconsistent validation, missing access checks, unhandled errors, unvetted dependencies and tests that assert little.

  • Performance and reliability

    Repeated database calls, blocking operations, missing timeouts and weak error handling that cause slowdowns and failures under load.

  • Dependency and license audit

    Outdated packages, known vulnerabilities and license obligations, with an update plan that flags breaking changes.

  • Prioritized findings report

    Each finding with evidence, severity, business impact and a recommended fix with code examples, plus a summary for decision-makers.

How a code audit runs

  1. 01

    Scope and context

    Agree goals, focus areas and access. Short conversations with your team cover business priorities, history and known pain points.

  2. 02

    Automated analysis

    Static analysis, dependency and secret scans run with AI-assisted triage, and a map of the codebase shows where manual review matters most.

  3. 03

    Expert review

    Engineers read critical paths, verify each finding, rate severity by business impact and write fix guidance with code examples.

  4. 04

    Walkthrough and plan

    We walk your team through the findings, answer questions and agree a remediation plan, with our help on fixes if you want it.

Two ways to work with AI tools

AI helps draft tests and investigate defects. Choose where it may process your code and test data.

Not sure? We'll recommend one during scoping. Compare AI delivery options

Typical audit requests

Typical scenarios we scope, not client case studies.

  • Refactor, rebuild or keep extending

    A CTO must choose between extending a fragile codebase and rebuilding parts of it. We review structure, tests around core business rules and dependency health, then set out the options with their risks; the call is theirs to make.

  • A billing rewrite done with AI tools

    A team rewrote its billing logic with heavy help from AI coding tools ahead of a major release. We review the changed modules, trace how amounts, discounts and refunds flow through them, and flag paths that need tests before it ships.

  • Technical due diligence before investing

    An investor wants an independent view of a startup's codebase before committing. Within an agreed scope, we assess architecture, security and dependency risk, and write a summary non-engineers can act on, with the technical detail attached.

What an audit doesn't include

  • We read and analyze code, not a running system; live attack testing is Penetration Testing or API Security.
  • Whether the product does what users need is tested in Software QA & Testing; the audit reports where the code makes defects likely.
  • Real response times under traffic are measured in Performance Testing; the audit points to likely causes in the code.
  • License findings are technical flags, not legal advice; your lawyer makes the final call.

How the audit connects to design, QA and operations

  • Design: front-end consistency

    Front-end code is checked for accessibility issues and drift from your design system. Fixes that change the experience are agreed with designers.

  • QA: regression tests for fixes

    Each confirmed issue gets a regression test, so a later change, by people or AI tools, doesn't quietly bring it back.

  • Operations: config and deployment

    Secrets, configuration, logging and deployment scripts are reviewed with the code, and operational risks go to whoever runs production.

  • Ongoing: review as you ship

    Recurring reviews of high-risk or AI-generated pull requests keep new code to the standard the audit set, under a plan agreed with you.

FAQ

Frequently asked questions

How long does a code audit take?

It depends on the size of the codebase, the areas in scope and how deep the review needs to go. After a first look at the repository, we agree a fixed scope and timeline with you before the audit starts.

Can you review AI-generated code before it reaches production?

Yes. We review it like any other code, plus targeted checks for problems generated code can introduce: duplicated logic, inconsistent validation, missing access checks, invented or unvetted dependencies, and tests that confirm the code rather than the requirement. It can be a one-off audit or a recurring review of pull requests.

Can you help implement the fixes?

Yes. Our engineers can fix high-priority issues directly, work alongside your team or review your fix pull requests. Each fix is verified and, where practical, covered by a regression test.

What access do you need, and where is our code processed?

Read access to repositories and documentation is usually enough; production access is rarely needed. AI-assisted analysis runs only within the boundary you choose: with Private / Local AI Engineering, models run on infrastructure you control or in an isolated environment we agree; with Claude Code / OpenAI Codex Engineering, commercial providers process code under agreed data-handling and retention terms.

View all case studies
View all projects
View all articles

Get an honest look at your code

Tell us what the code does, how it was built and what you need to decide. We'll suggest an audit scope to match.

Discuss your projectRequest a code audit