AI code audit
An AI code audit for software built with AI tools.A senior engineer checks what is actually there before it goes live.
Built with Cursor, Bolt, Lovable, v0, Codex or another AI tool, by you or by an agency using them. AI tools write to the spec they are given and do not flag what should have been in it. I read the code, run it, and tell you in plain English what is ready and what to fix before you ship.
Price
Same three tiers, same fixed fee.
From £3,500
- Clarity Audit: From £3,500, 5 business days
- Production Audit: From £6,500, 7–8 business days
- Regulated & Investor-Ready: From £9,500, 10–12 business days
What sets the tier and the fee: how much there is to review, how many moving parts it has, what is at stake if it fails, and what access and documentation exist. A scoping call settles it before you commit. All prices exclude VAT. One fixed fee, agreed in writing before you commit: 50% on engagement, 50% on delivery. Review and remediation are quoted separately.
-630% → +36%
TURNAROUND
Support-agreement profitability in 6 months
Dexus · NTT · Kalibrate · Lancom
ENGAGEMENTS
Plus NDA'd startups and government
Twelve years
ENGINEERING DEPTH
Full-stack to CTO
Who it is for
Who this is for.
This is for you if
- You built it yourself with AI tools and you are about to go live.
- An agency or freelancer built it with AI assistance, and you want independent confirmation that it is ready.
- It works in the demo, and you are not sure it is solid enough for real users and real data.
This is not for you if
- You want an automated scanner run over the code. This is a senior engineer reading and running it.
- You want the code rewritten as part of the review. Remediation is quoted separately.
- You need a penetration test of your live system. This review reads and runs the code; it does not attack production.
What is covered
What typically goes wrong, and what the review checks.
AI-assisted code often has the shape of something a senior engineer wrote: sensible names, comments, even error handling. Shape and substance are not the same thing. These are the weak spots I look for first. The rest of the review is the standard code and architecture review.
Authentication that only works on the happy path
Login and permissions that pass in testing and break under specific conditions.
Validation in one layer only
Data validation that passes at the API and falls apart at the database.
Session handling
Sessions and responses that could let a determined attacker enumerate users.
Secrets in the wrong places
Keys and credentials in code, in config, or shipped to the browser.
Errors that say too much
Error handling that exposes stack traces or internal detail to the client.
Untested integrations
Third-party services that have not been tested for slow, failing or unexpected responses.
FAQ
Common questions before booking.
Is AI-written code bad?
Not necessarily. Plenty of it is fine. The review judges the code that is there, not how it was written, and if it is sound the report says so, with the evidence.
Does it matter which AI tool was used?
No. Cursor, Bolt, Lovable, v0, Codex or anything else: the review looks at the code, the running application and the configuration, whatever produced them.
Do you deal with AI-generated software?
Yes. Much of the software I review is built with AI tools, or by agencies using them. It gets the same review as any other codebase, with extra attention to the weak spots those tools tend to produce, such as authentication that only works on the happy path, validation in one layer only, and secrets in the wrong places.
What do I get, and how does it run?
The same Confidence Report as any other review: a verdict of continue, fix first or rebuild, a one-page summary and every finding with its evidence. Access, process, fees and confidentiality are the same too.
Get a senior read before it goes live.
Tell me what you built, what you built it with and what worries you. I will tell you whether a review fits and which tier.
Book a scoping call