Every angle, not just the fast one.
An audit is not a performance report. We take the system apart across design structure, cybersecurity, the quality of its models and its behaviour under load, quantify each finding, and land the fixes in whatever language the code is already written in.
- Duration
- 3 weeks · fixed scope
- Input needed
- repo access + a load profile
- Week 1
- instrument & reproduce
- Scope
- structure · security · models · performance
- Week 2
- ranked findings + prototypes
- Week 3
- merged fixes + CI gates
- Output
- report · pull requests · benchmarks
No rewrite recommendation unless the numbers demand one
Three weeks, four stages.
Reproduce
Your load, replayed on a rig we can profile.
Rank
Every finding carries an effect size and an effort figure.
Land
Fixes as small PRs, benchmarked individually.
Lock in
Thresholds in CI so the gain can't silently rot.
You keep everything: rig, benchmarks, traces and notes
Six dimensions, scored before and after.
Each dimension is scored against evidence we can show you: traces, threat models, back-tests, benchmarks. Nothing in the report is an impression.
- Structure44 → 82
Module boundaries, coupling, dead paths, migration risk and the seams a change actually has to cross.
- Security38 → 91
Authorisation at the data layer, secret handling, dependency and supply-chain exposure, tenant isolation.
- Models51 → 88
Leakage, calibration, drift monitoring and whether the reported accuracy survives an honest out-of-time split.
- Performance47 → 89
Profiles under production-shaped load, query plans, contention and the cost of the tail rather than the mean.
- Data42 → 85
Schema constraints, referential integrity, idempotency of writes and what happens on a partial failure.
- Operability35 → 87
Tests worth trusting, deploy and rollback, observability, and whether an incident is diagnosable at 3am.
Scores are evidence-backed and rescored after remediation, so the improvement is a number rather than a claim.
What gets fixed first is arithmetic.
Every finding carries a measured impact and an effort estimate. The order falls out of the ratio, so nobody argues about severity labels.
- 01N+1 query on the hot pathperformance5.3×
- 02Missing row-level authorisationcybersecurity4.4×
- 03Target leakage in scoring modelmodel quality2.9×
- 04Unpinned dependency treecybersecurity2.7×
- 05No calibration monitoringmodel quality2.2×
- 06Non-idempotent payment writedesign structure2.2×
- 07Lock contention under peakperformance1.5×
- 08Service split along wrong seamdesign structure0.8×
Anonymised engagement. The top four items carried most of the recoverable value and cleared inside week three.
From generated prototype to a real application.
AI coding tools are genuinely good at producing something that demos. What they rarely produce is authorisation that holds, data that stays consistent, models that survive a fair split, or a system anyone can operate. That gap is exactly what an audit is for.
- Authorisation and tenant isolation18% → 94%
- Data integrity and idempotency26% → 92%
- Meaningful test coverage21% → 84%
- Model validation and calibration30% → 88%
- Performance under real load34% → 90%
- Observability and rollback12% → 89%
- gate 01Threat model and data boundary
Who may read which row, enforced where the data lives rather than in the UI.
- gate 02Invariants in the schema
Constraints, transactions and idempotent writes so retries cannot corrupt state.
- gate 03Honest evaluation
Out-of-time splits, leakage checks and calibration before any model decides anything.
- gate 04Load and failure rehearsal
Profiled at expected peak, then deliberately broken to see how it degrades.
- gate 05Operable release
Tests, tracing, alerts and a rollback path, so the team can run it without us.
We keep the parts that work. The result stays your codebase, in your repository, with the demo still working on day one.
Why this isn't a consultancy report.
Book the first week.
If week one finds nothing worth fixing, we say so and stop billing.
Request an audit