Codebase Review
A codebase review is a fixed-price engineering read of your application that tells you three things: what is currently unsafe, what will break under real use, and what it would actually take to get to production.
Most people arrive here without a clear picture of what they have. The app works when they click through it. Something feels wrong anyway, or an AI tool started making changes that broke things it had already fixed, or a friend who writes software looked at it and went quiet.
The review answers that. Two engineers read the repository end to end, run it, look at how data is actually protected, and write up what they find in order of what would hurt you first. You get the document whether or not you ever work with us again.
This sounds like you if…
- “It works, but I have no idea if it's safe to put in front of real users.”
- “Someone told me my database is exposed and I don't know how to check.”
- “I want to know what I actually own before I spend more money on it.”
- “An investor or a potential customer is asking technical questions I can't answer.”
- “I need to know if this is fixable or if I should start over.”
What this covers
- Read the entire repository, not a sample. Large AI-generated codebases hide their problems in the parts nobody looks at.
- Check how your data is actually protected at the database layer, not just in the UI. Client-side checks are not access control.
- Look for credentials committed to the repository or shipped in the browser bundle, and tell you which ones need rotating today.
- Verify that authentication and authorization are enforced on the server for every route that reads or writes user data.
- Check dependencies for packages that do not exist upstream, are unmaintained, or carry known advisories.
- Assess whether the structure can absorb another six months of features, or whether it has reached the point where changes reliably break unrelated things.
- Deliver a written report that separates 'fix before you launch' from 'fix before you scale' from 'this is fine, ignore the internet'.
What this is not
Stated up front so nobody buys the wrong thing.
- This is not a penetration test. We read code and configuration; we do not attack your running system.
- It is not a security certification, and it cannot prove the absence of vulnerabilities.
- It does not include making the fixes. The report is written so that any competent engineer can act on it, including one who is not us.
Worth knowing
Codebase Review — questions
What do you need from me to start?
Read access to the repository, and the ability to run the app or see it running. If your code currently lives inside a hosted builder, we will walk you through exporting it to a GitHub repository you control, which is worth doing regardless.
Will you tell me to rebuild from scratch?
Only if that is genuinely cheaper than fixing, and we will show the reasoning. Rebuilds are the most expensive recommendation a vendor can make, which is exactly why you should be sceptical when one is proposed without evidence. Working software with problems is usually worth more than the plan to replace it.
Do I have to hire you afterwards?
No, and the review is priced so that it stands alone. If you do want us to carry out the fixes, we will quote that separately once the scope is actually known, which is the only point at which a quote means anything.
How is this different from running a scanner?
Automated scanners check whether a security policy exists. They cannot check whether it is correct — whether the rule that lets a user read their own records also accidentally lets them read everyone's. Most of the findings that matter in AI-generated apps are logic problems of exactly that kind, and they require someone to read the code.
Not sure how bad it is? That's the normal starting point.
Tell us what you built and what's worrying you. If the honest answer is that you don't need us, we'll say so.