Support service
Get an independent view of your code
Before you accept a vendor’s delivery, take over a codebase or commit to a plan, you need an outside opinion based on evidence. We audit the code and give you a prioritised fix list.
- Duration
- 1 to 3 weeks
- Model
- Fixed scope
- Output
- Audit report and quality baseline
When an independent audit pays off
An audit is most useful at a decision point, when an outside view changes what you do next.
- An external vendor has delivered code and you need to decide whether to accept it.
- You are about to take over a codebase from another team or company.
- Your team says the code is fine; the delivery speed says otherwise.
- A key engineer is leaving, and nobody else understands parts of the system.
- Security questionnaires from customers ask about practices you cannot evidence.
- Dependencies have not been updated in years and nobody knows what would break.
- Test coverage is unknown, and every refactoring feels like a risk.
Evidence, not opinions
Code reviews by the team that wrote the code have a blind spot: familiarity. An external audit reads the code with no history, which is exactly how the next engineer, the next vendor or an acquirer will read it.
We combine tooling and reading. Static analysis, dependency and licence scans, test coverage and change history show where the risk concentrates. Then architects read the hotspots, the parts that change most often and break most often, where quality matters most.
Every finding comes with evidence, impact and an estimated fix effort. The result is a fix list you can act on in order, and a baseline you can measure progress against.
Scope
Included
- Static analysis and code quality metrics
- Hotspot analysis from change and defect history
- Architecture conformance: layering, boundaries, dependencies
- Test coverage and test quality review
- Dependency health and licence scan
- Security hygiene in code: secrets, input handling, use of authentication
- Build and delivery pipeline review
- Readability and onboarding cost
Not included
- Penetration testing
- Infrastructure and cloud cost review
- Fixing the findings
- Legal opinion on licences
How the audit runs
- Day 1Access and scope. Read-only repository access is set up, and the questions the audit must answer are agreed.
- Week 1Measure. Static analysis, dependency scans, coverage and change history are collected, and the hotspots are identified.
- Week 2Read and assess. Architects read the hotspots and the core paths, and every finding is written down with evidence and a fix estimate.
- Final daysReport and walkthrough. The report and the fix list are walked through with your team, and the questions raised are added to the report.
What you receive
The report is yours to share with your board, your vendor or your team.
Who this service is not for
- Teams that need a formal security certification. A code audit is not a penetration test or a compliance audit.
- Situations where the answer is already decided and a report is needed only to confirm it.
- Very small codebases where a single review session would be enough. We will suggest that instead.
Frequently asked questions
How is this different from an Architecture Assessment?
A code audit focuses on the codebase. An Architecture Assessment also covers infrastructure, delivery, operations and cost, and ends with a 12-month roadmap.
Can we use the report with our vendor?
Yes. Findings are written with evidence so they can be discussed factually with the team or company that wrote the code.
Which languages do you audit?
Mainly .NET and C#, Go and Python backends. For other languages we tell you in the first call whether we can audit them to the same standard.
Do you need access to production?
No. Read-only access to the repositories and, if available, the defect tracker is enough.
Will the audit disrupt our team?
Very little. We ask for a short kick-off, a few questions during the audit and the final walkthrough.
Start with a short technical call
Thirty minutes. You tell us which decision the audit should support, and we tell you what it would cover.