A fixed $3,500, with the report 5 working days after we get access. We read your code, run it and check how safe it is. You find out what state it's in, who can reach your data, and what to keep, fix or rebuild. Take the report to any team, or have us fix it at $39-55 an hour. Clients rate us 4.8 out of 5 on Clutch from 70 reviews.
You get a written report in plain words, the findings as a spreadsheet any team can work from, and a 60-minute call where we go through them with you. Act on it with us or with anyone else. You buy the audit on its own, and we don't take its price off later work, so our verdict doesn't depend on whether you hire us.
Every account the product depends on, from the code and servers to the domain, the app stores, Stripe and outside services. Whose name each one is in, and what to get back from the old team.
Whether it builds and runs as handed over, how it is organized, how much of it has tests, where logic is copied around, which libraries are outdated or unsafe, and whether a new developer could pick it up.
Who can see whose data, where passwords and secret keys are kept (old commits included), what is open to the internet that shouldn't be, and how payments are confirmed.
A diagram of the parts, the outside services and where the data lives, as we found them.
For each part of the product: keep it, fix it or rebuild it, and why.
The fixes in order, each with an hours range at $39-55 an hour, so you know the cost of every next step before you say yes.
We read the code and run it, looking for what could lose you users or money.
One user should never reach another user's records. We check that the app stops them.
Where they are kept, old commits included. A key that was ever in the code has to be replaced.
Anything people can reach from outside that should be closed.
Does your server get proof from the payment provider, or does it trust a thank-you page?
Does it build and run as handed over? We look at how much of it has tests, where logic is copied around, and if a new developer could pick it up.
Which outside libraries are outdated or unsafe, with the worst first.
AI tools write code fast, but AI alone doesn't get an app to production quality. A senior engineer has to read the code and decide what is safe to ship. That is what this audit gives you, for apps built with Lovable, Bolt, Cursor, Replit or similar tools. These are the problems we look for first.
AI tools sometimes paste a secret key straight into the code to get a feature working. Any key in the code sent to the browser can be read by anyone who looks.
Many AI builders connect the app straight from the browser to a hosted database. That's safe only when every table has access rules.
A thank-you page doesn't prove anyone paid. Your server has to check what the payment provider sends, or fake events can unlock paid access.
A demo works with one test user. Without tests for sign-up and payment, the next prompt can break them and nobody will know.
Are backups switched on, has anyone restored one, and can a prompt or a test run touch real customers' records?
The code, the domain, Stripe, the database and the AI provider should be in your company's name, with at least two people able to log in.
If your app holds names, emails or other personal data, we look at how the code stores and handles it. What we find goes in the report with everything else, worst first.
Which databases and files hold personal data, and how passwords are stored.
Which users, staff accounts and parts of the app can read or change it.
Which outside services get personal data from your app.
That pays for the written report, the findings as a spreadsheet and a 60-minute call to go through them.
The 5 days start when we have read access to your code repositories and to the hosting or a staging copy.
One product with up to 3 codebases and up to about 100,000 lines of your own code. We price bigger products by the hour, at $39-55.
You buy the audit on its own, and we don't take its price off later work, so our verdict doesn't depend on whether you hire us.
The report is yours, and you can stop there. Take it to your own developers or to any other team: the spreadsheet of findings is made for that. Or have us do the fixes at our public rate of $39-55 an hour. The report already puts an hours range on each fix, so you know the cost before you say yes.
See how software project rescue works.
App stuck with another team? We take the project over and ship it, starting from the audit.
Nine things to check before strangers sign up and pay, and how to tell whether to keep, fix or rebuild.
A part-time CTO for technical decisions, 10, 20 or 40 hours a month at $39-55 an hour.
Describe your project and get the scope, hours, budget and timeline in about four minutes.
Tell us what the product does and what worries you, or ask for a call. We'll tell you what we would check first. You don't need to share code yet.