A code audit service for software your team did not entirely write

Most code in most products now has an AI somewhere in its history, and that changes what an audit needs to look for. The classic review hunted for the mistakes tired humans make. The current one hunts for the mistakes confident models make, which are different, more consistent, and much easier to miss because the code reads well.

We run this as a fixed-price, fixed-length piece of work with a written report at the end. No engagement attached, no obligation to have us fix anything. Plenty of clients take the report to their own team, and that is a perfectly good outcome.

AI-written code fails on a narrow, predictable set of things. Access rules assumed rather than enforced, so the interface hides a button while the endpoint stays open. Secrets placed in client code, because the example the model learned from was a script. Queries with no index behind them. Retries with no cap. Validation on the form and not on the server.

The pattern behind all of them is the same: a model answers the question it was asked. “Build a page that shows the user’s orders” does not contain the instruction “and make sure it cannot show anyone else’s”. The code satisfies the request completely and leaves the system wrong, which is exactly the class of defect that survives review by people who are not looking for it.

Most audit reports are unusable by the person paying for them: a spreadsheet of severity ratings that tells a founder nothing about whether to launch on Tuesday. We write two layers. The first is plain language, roughly two pages: what the real risks are, what happens if you do nothing, and what we would do first.

Underneath sits the detail your engineers need, with file references, reproduction steps, and a suggested fix for each finding. Same document, both audiences, so nobody has to translate between them and nothing gets lost when they do.

The uncomfortable arithmetic is that the cheapest finding to fix is almost always the most expensive one to ignore. An unenforced access rule is an afternoon of work before launch and a disclosure obligation afterwards. A missing index is one line before it becomes a support queue and a database bill.

That is the whole argument for doing this early. Auditing a small codebase costs less, finds fewer things, and the fixes are cheaper because less has been built on top of them. Auditing after the incident costs the same and buys you much less.