A web app audit for the system you've inherited
Know what you've inherited before anyone touches it. We review the security, code, hosting and data of a web app someone else built, and give you a written report with a plan for what to do next.
Trusted by clients from global brands to local charities
Where an audit usually starts
What the audit covers
What we look at, and what you get at the end.
- Security: sign-in, access rules, secrets and known vulnerabilities
- Code: structure, tests, dependencies and how safely it can be changed
- Hosting: where it runs, what it costs and what happens when it fails
- Data: where it lives, who can see it, backups and recovery
- Integrations: what it's connected to and how fragile those links are
- Performance: the slow screens and why
What you get: a plan for every part of the app
The report sorts everything we found, so the decisions are clear and the first fixes are obvious.
Sorted: sound, at risk, fix first
- SoundLeave it as it is
- Sign-in
- Hosting set-up
- Data model
- Most screens
- At riskImprove it soon
- Access rules
- Old dependencies
- Slow reports
- No tests
- Fix firstBefore anything else
- A key in the code
- Untested backups
- Open admin page
How an audit runs
Four steps, and nothing of yours is changed along the way.
What clients say about working with us
Questions about the audit
No. The report is yours to act on, with us or with anyone else.
Read-only access to the code and the hosting, a copy of the data if the review needs it, and an hour with whoever knows the system best.
No. Changes come afterwards, as a plan you've agreed.



