AI-generated code audit · 5–10 days · fixed price
You built it fast with AI. Is it safe to scale?
A senior engineer reads your code the way an attacker — and the next developer — will. Secrets, authorisation, payments, dependencies, tests and architecture. You get findings with evidence, a fix plan in order of risk and a fixed price for the fixes.
Read-only access, NDA first. Works for Cursor, Copilot, Claude Code, Lovable, Bolt, Replit and contractor-built code.
- Day 1Repo access · stack: Next.js, Supabase, Stripe
- Day 2secrets.scan() · 2 API keys committed to history
- Day 3authz.review() · row-level security off on 4 tables
- Day 4tests.coverage() · 6% · payments untested
- Day 5deps.audit() · 3 packages with known CVEs
- Day 7Report · 14 findings · fix plan · fixed price
- from access to a written report
- 5–10 days
- fixed price, agreed before we start
- from €3k
- findings that matter, not 400 scanner lines
- Top 10
- fix or rebuild, module by module
- 1 verdict
What we usually find
Six problems in almost every AI-built codebase
- 01Secrets and keys in the code
API keys, database URLs and tokens committed by tools that do not know better.
- 02Authorisation gaps
Endpoints and tables any logged-in user — or anyone — can read or change.
- 03No tests on the money path
Sign-up, payments and data exports that nobody has ever tested automatically.
- 04Dependencies nobody chose
Packages added by an assistant, outdated or vulnerable, with no update routine.
- 05Architecture that will not scale
Everything in one file, no separation of concerns, no error handling or logging.
- 06Nobody understands it
The founder or a contractor generated it; the next engineer cannot maintain it.
How the audit works
Ten working days. Nothing changed without consent.
What we check
- Secrets, keys and tokens in code and history
- Authentication, authorisation and row-level security
- Payment, sign-up and data-export paths
- Dependencies, licences and known CVEs
- Test coverage on the paths that make money
- Architecture, error handling, logging, cost
- Cloud, CI/CD and environment configuration
- Prompt injection and data leaks in LLM features
- 1
Access and NDAday 1
Read-only access to the repository and, if possible, staging. Your NDA or ours. Nothing is changed without your written consent.
- 2
Reviewdays 2–6
Secrets, authorisation, data access, payments, dependencies, tests, architecture and infrastructure — automated scans first, then a senior engineer reads the critical paths by hand.
- 3
Report and readoutdays 7–10
Findings by severity with evidence, a fix plan in order of risk, a fix-or-rebuild verdict per module and a fixed price for the fixes. A one-hour readout with your team.
- 4
Fix — optionalfixed price
We fix it, a senior joins your team, or your developers fix it with the report in hand and we re-check.
What you get
A report your investors, customers and next developer can read
One-page summary
For the founder and the board: risk level, top issues, cost to fix.
Findings with evidence
Severity, file and line, how to reproduce, how to fix.
Fix plan in order of risk
What to fix this week, this month and before scaling.
Fixed price for the fixes
Optional. Or your team fixes it and we re-check.
FAQ
Questions we hear first
How much does the audit cost?
From €3k for a single application up to about 30,000 lines of code; €5–8k for larger or multi-service systems. The price is fixed before we start.
What is “vibe-coded” or AI-generated code?
Code written mostly by AI assistants or app builders from prompts. It is often fast to produce and works in a demo, but frequently ships with security holes, no tests and an architecture nobody can maintain.
What access do you need?
Read access to the repository and, if possible, to a staging environment. We sign your NDA first and change nothing without your consent.
What do we get?
A written report: findings by severity with evidence, a fix plan in order of risk, an honest view on whether to fix or rebuild parts, and a fixed price for the fixes.
Can you fix it afterwards?
Yes — for a fixed price, or by putting a senior engineer on your team. Or your developers fix it with the report and we re-check.
How is this different from running a scanner?
Scanners find known patterns and produce hundreds of findings nobody reads. We run them too, then a senior engineer reads the critical paths — sign-up, payments, data access — and tells you which ten things actually matter and what fixing them costs.
Is this useful before fundraising or an acquisition?
Yes. Investors increasingly ask who reviewed the code. The report doubles as a technical due-diligence pack: what is solid, what is risky, and a costed plan.
Next step
Find out what you built — before someone else does.
Book 30 minutes. Tell us the stack, the size and what worries you. You get a fixed price and a start date for the audit.
- Read-only access, NDA first
- Report in 5–10 working days
- Fixed price, agreed upfront
You will talk to
Gleb Zamyslovsky
Executive Officer · Warsaw
One reply within a business day: questions, a fixed price, or an honest “not worth it”. No account managers in between.