Code audit services
A code audit and architecture review in two weeks
This is for founders and CTOs with a codebase they inherited or built in a hurry: an agency's work, a cofounder's prototype, or an MVP made with AI tools like Lovable, Bolt or Cursor that now has real users. Before a raise, a big hire or a scale-up, you need to know what's in it. So do teams worried about security, or about a cloud bill nobody can explain.
In two weeks we review the architecture and the code, rank what we find and estimate the effort to fix each problem. The review is done by Sachin Mour, CTO at Hexis, who led Emblem's platform as CTO. He still writes code, so each finding says how to fix it, not just what's wrong.
Fixed price: a code audit in two weeks
For one product, meaning the app, its backend and one cloud account, we review the architecture and the code in two weeks. It's a fixed price, from $5,000, and you get the exact figure in writing before we start. If you book fractional CTO time or fixes with us within 60 days, the fee counts toward them.
Several services, regulated data such as health or payment records, or a bigger team usually brings the price to $8,000 to $12,000. We quote it on the first call.
Penetration tests, where security testers attack the running system, and compliance audits aren't included.
When a code audit is worth it
Before a raise
Investors may look at your code before they invest. Find the problems first, and fix the cheap ones before anyone asks.
Before a big hire
A new CTO or senior engineer gets up to speed faster with a written map of the system and its risks.
Before a scale-up or a rewrite
Find out what breaks first with ten times the users, and whether a rewrite is needed at all.
After inheriting a codebase
From an agency, a freelancer or a cofounder who left, when nobody on the team knows why it works.
An AI-built MVP with real users
Apps built fast with Lovable, Bolt or Cursor often work in a demo and leave gaps underneath. Our security checklist for Lovable apps covers the common ones.
Worries about security or cost
A customer's security questionnaire you can't answer, or a cloud bill that grows faster than your users.
What we check
We start with the paths that carry sign-ins, payments and customer data, and follow each one through the code and the cloud account.
Architecture
How the parts fit together, where data flows, and what breaks first as usage grows.
Code and tests
Whether a new engineer can change it safely, which paths have tests, and how far its third-party libraries have fallen behind.
Security
Sign-in, permissions, passwords and API keys left in the code, and API routes anyone can call. In Supabase apps, that includes row level security (RLS), the database rules that decide who can read each row.
Data
The data model, slow queries, how schema changes are made, and whether anyone has ever restored a backup.
Deploys and monitoring
How code gets to production, which steps are manual, and whether you hear about errors before your customers do.
Running cost
What drives the cloud bill, and how it grows with each new customer.
How the two weeks run
Kickoff and access
A call with you and whoever built the system. You give us read-only access to the code, the cloud account and any docs.
Week one: trace the system
We read the code, follow the critical paths and talk to your engineers. Your team keeps shipping while we work.
Week two: rank and write
Each finding gets evidence from your code, an effort estimate and a priority: fix now, fix this quarter or leave alone. Then we write the 90-day plan.
Walkthrough
A 60-minute call to go through the report with your team, and a fixed quote for the top fixes if you want us to do them.
Who it's for, and who it isn't
A good fit
- One product with real users, built fast or inherited.
- A raise, a senior hire or a scale-up in the next few months.
- A founder or CTO who will act on the findings.
Not the right fit
- You need a penetration test or a compliance audit. For SOC 2 or HIPAA readiness, see HIPAA and SOC 2 engineering.
- You're an investor checking a company before you invest. That's technical due diligence.
- Nothing depends on the code yet. If it's a prototype you may throw away, start with a free call instead.
What you get
Ranked findings
Each risk with evidence from your code and the effort to fix it, sorted into fix now, fix this quarter and leave alone.
A 90-day plan
The order to tackle the top risks in, so the team can start the following week.
A one-page summary
What matters most and what it costs to fix, written for founders and investors.
A technical appendix
Where each problem sits in the code and how we'd fix it, written for your engineers.
A walkthrough call
A 60-minute call with you and your team to go through the findings and the plan.
A quote for the fixes
A fixed price for the top fixes, if you want us to do them. The audit fee counts toward fixes booked within 60 days.
What we've done for clients
Hexis
Rebuilding the platform behind elite sports nutrition
When Sachin started at Hexis in mid-2024, loading a few days of plans could take minutes, and the company was heading into its seed round. The cause was the data model, which spread years of history across many joined tables. Rebuilding it took multi-day queries from several minutes to under 700ms, a key factor in closing the $2.1M seed round.
Read the Hexis case studyEmblem
AI due diligence that cites its sources
Sachin led Emblem's platform as CTO, including the Google Cloud infrastructure and the security work behind its SOC 2 program. Emblem has completed SOC 2 Type II.
Read the Emblem case studyHow a project starts
From a free call to the end of the second week.
A free 30-minute call
Tell us what the product does, how it was built and what worries you about it. We'll tell you whether an audit is the right step and what it would cost.
A fixed price, or hourly
After the call we send a fixed-price quote for a clear scope, or agree on hourly work at $100 to $150 an hour. The audit is a fixed price from $5,000 for one product, and usually $8,000 to $12,000 for bigger systems. If you book fixes or fractional CTO time within 60 days, the fee counts toward them.
The first two weeks
- A kickoff call, then read-only access to the code, the cloud account and any docs.
- We trace the critical paths through the code and talk to the people who built it.
- At the end of week two, you get the report, the 90-day plan and a 60-minute walkthrough.
Frequently asked questions
What's the difference between a code audit and an architecture review?
A code audit reads the code itself: how it's written, tested and secured. An architecture review looks at how the parts fit together: data flow, infrastructure, scaling and cost. The worst problems usually sit where the two meet, so we do both in the same two weeks.
How much does a code audit cost?
From $5,000 for one product over two weeks, at a fixed price agreed before we start. Several services, regulated data or a bigger team usually comes to $8,000 to $12,000. If you then book fractional CTO time or fixes with us within 60 days, the fee counts toward them.
What do you need from our team?
Read-only access to the code, the cloud account and any docs, a kickoff call, and some time with whoever knows the system best. Your team keeps shipping while we work.
Can you audit an app built with Lovable, Bolt or Cursor?
Yes. AI-built apps often look finished and leave gaps underneath: database tables anyone with the app's public key can read, secret keys shipped to the browser, no tests, and backups nobody has restored. We check those first. To check some of it yourself, start with our security checklist for Lovable apps.
Is a code audit the same as a penetration test?
No. We review security as part of the code and the architecture: sign-in, permissions, keys and exposed API routes. In a penetration test, security testers attack the running system to find a way in. A compliance audit checks your controls against a standard like SOC 2. Neither is included.
Will you fix what you find?
If you want us to. The walkthrough comes with a fixed quote for the top fixes, and if you book them within 60 days, the audit fee counts toward them. Or take the report to your own team: the technical appendix is written for them.
Which languages and stacks do you review?
We know TypeScript, Node.js, React, React Native, Python, Go and PostgreSQL best, on Google Cloud, AWS and Supabase. If your stack is outside that, we'll say so on the first call rather than learn it on your time.