A code and architecture audit is an independent review of software you did not write — before you acquire it, take it over from another vendor, or spend another six figures on it. One engineer reads the codebase, the database schema and the infrastructure, profiles what is genuinely slow, checks the security posture, and delivers a written report that ranks every finding by risk and by the hours it takes to fix.
The seller demos the happy path and tells you the code is clean. An audit gives you a second opinion before the wire goes out: what is actually in there, what it costs to bring to standard, and which findings are grounds to renegotiate.
No documentation, no author, no idea where anything lives. We reconstruct the structure, the data model and the path to production, then mark the parts of the system that are dangerous to touch without preparation.
"Slow" almost always resolves into three or four specific queries and one screen that was designed wrong. We profile the database and the application under realistic load and show you where the seconds actually go.
How passwords and tokens are stored, who can read whose data, which admin panels and ports face the internet, what secrets sit in the git history. Every finding carries a risk level, not a vague "should be hardened".
A $3,000 quote for something that smells like forty hours is a normal reason to call us. We read the requirement technically and tell you what it is worth in hours before you sign anything.
When editing a price in one module breaks reporting in another, the problem is module boundaries and missing tests, not the developers. We show where the coupling is unnecessary and the smallest set of tests that stops the regressions.
We start with what the audit is for: an acquisition, a dispute with a vendor, or production being slow. Then we need read-only repository access, a database dump or replica, and view access to monitoring and hosting.
A human reads the code, not only the linters: module boundaries, data model, migrations, error handling, test coverage, commit history. We flag every area that exactly one person in your company understands.
Slow queries pulled from pg_stat_statements and EXPLAIN, application profiling, key flows replayed under load. Every "it's slow" turns into a named query, a missing index or an N+1.
Authentication and authorisation, secrets in the repository, dependencies with known CVEs, exposed ports, backups and an actual restore test, CI/CD. We work down the OWASP ASVS checklist.
You get the written report — findings by risk level, the consequence of leaving each one, an hour estimate per fix — plus an hour on a call going through it, so the list is usable by whoever ends up doing the work.
If we do the fixing, we take the top of the list and work hourly or on a monthly retainer. Everything we ship carries a one-month warranty.
Tooling follows the project's stack — auditing Node/Postgres and auditing PHP/MySQL are different routes through the same checklist. Below is what comes up most often; the report itself is written by an engineer, not exported from a linter.
20–40 hours. Repository and infrastructure end to end, no deep profiling. You get a map of the system and the ten findings that actually matter, each with an hour estimate. Enough to decide buy or walk away.
50–100 hours. Code, database schema, performance under load, security checklist, CI/CD and a backup restore test. Full report with priorities and hours per item, plus a walkthrough call. Codebase size and service count move the number.
The audit plus work on the top of the list: indexes and queries, bottlenecks, critical security holes, a deployment path that stops being scary. After that, an optional retainer from $400 / 40 000 ₽ a month with a dedicated engineer.
Prices are indicative and do not constitute a public offer. The final cost, scope and timeline are fixed in a contract or invoice after we have discussed the task.
The audit checklist comes out of systems we run ourselves. KMD is a CRM we built from scratch for a large HoReCa service company: 12+ modules, 89 database migrations, access split across 9 roles and 87 permissions. Those are exactly the places we open first in someone else's product — the permission matrix, the migration history, the seams between modules.
Read the KMD caseThe scoping call and the estimate are free, with no obligation. We reply within two hours during business hours and tell you honestly whether you need the full audit or the express one.
Discuss your task