Code and architecture review
An independent review of your code and architecture.Continue, fix first, or rebuild.
Before you ship it, fund it, or take it over from the people who built it, a senior engineer reads the code, runs the application and its tests, and tells you in writing what is solid, what is fragile and what to fix first. One fixed fee, agreed before you commit.
Price
Three tiers. One fixed fee.
Set by depth and what is at stake, not by line count. One figure, in writing, before you commit.
Clarity Audit
From £3,500
Timeline:5 business days
Best for: Internal platforms, MVPs and early-stage products. Is it sound enough to carry on with?
Scope
- Security review: auth, OWASP Top 10, secrets, session handling
- Architecture spot-check: data flow, key design patterns, structural risks
- Dependency vulnerability scan
You get
- 12–18 page written report, findings by severity
- Fix recommendations with exact file and line references
- 1 × 45-minute walkthrough call
Production Audit
From £6,500
Timeline:7–8 business days
Best for: Going into production, or already taking real users, payments or sensitive data. Is it ready for users?
Scope
- Full OWASP, multi-tenancy, data isolation, third-party integrations
- Architecture review: scalability, coupling, error handling, logging
- Infrastructure and deployment config review
- Data handling and GDPR surface review
You get
- 20–25 page report: executive summary and full technical findings
- Developer-ready fix specs: exact file, line, and change required
- Phased remediation roadmap with effort estimates
- 2 × live calls (scoping and findings walkthrough)
- 30-day async Q&A support
Regulated & Investor-Ready
From £9,500
Timeline:10–12 business days
Best for: Regulated, high-risk or investor-facing builds. Will it stand up to scrutiny?
Scope
- Everything in Production Audit, plus:
- Compliance mapping: GDPR, FCA, CQC/HIPAA, whichever applies
- AI model integration risk assessment
- Infrastructure security: IAM, secrets management, environment separation
- Production readiness scorecard: pass / amber / fail per category
You get
- 25–35 page full technical report
- 3–4 page executive summary written for investors and board
- Developer-ready fix specifications
- Compliance readiness checklist, shareable with legal advisors
- Re-audit of critical findings after fixes applied (within 30 days, included)
- 3 × live calls: scoping, mid-audit, final walkthrough
- 30-day async support window
Not sure which tier? Try our free self assessment
What sets the tier and the fee: how much there is to review, how many moving parts it has, what is at stake if it fails, and what access and documentation exist. A scoping call settles it before you commit. All prices exclude VAT. One fixed fee, agreed in writing before you commit: 50% on engagement, 50% on delivery. Review and remediation are quoted separately.
Book a scoping call-630% → +36%
TURNAROUND
Support-agreement profitability in 6 months
Dexus · NTT · Kalibrate · Lancom
ENGAGEMENTS
Plus NDA'd startups and government
Twelve years
ENGINEERING DEPTH
Full-stack to CTO
Who it is for
Who this is for.
This is for you if
- An agency, contractor or previous team built it, and you want an independent read before you own the consequences.
- It was built with AI tools, or by an agency using them, and it is about to go live.
- You are about to commit further: funding, a scaling push, or a regulated launch.
- You want to know whether to keep building on what you have, fix it first, or start again.
This is not for you if
- You want the fixes made as part of the same fee. Remediation is quoted separately.
- You need a penetration test of your live system. This review reads and runs the code; it does not attack production.
- You are buying or investing in a company and need the wider picture of team, process and risk. That is technical due diligence.
What is covered
What the review covers.
Six areas, at a depth set by the tier you choose.
Authentication and authorisation
Token and session handling, role-based access, endpoint protection, and everything that controls who can see or do what.
Data handling and integrity
How data moves through the system, where it is validated and where it is not, write conflicts, and what happens when something fails part way through.
Security surface
OWASP Top 10, secrets management, CORS configuration, injection vectors, dependency vulnerabilities, and exposure at the API boundary.
Architecture and design patterns
Whether the structure holds under real load, including mobile or cross-platform apps and realtime or event-driven parts where they exist, where the single points of failure are, and which patterns tend to go wrong in production.
Third-party integrations
Payment providers, authentication services, AI APIs and webhooks: what happens when they are slow, down, or return something unexpected.
Infrastructure and deployment
Environment separation, secrets in config, logging and observability, and whether the production setup matches the security assumptions in the code.
What you get
A Confidence Report with a clear answer.
Continue, fix first, or rebuild. Written down, with the evidence behind it.
- A written Confidence Report with a verdict: continue, fix first, or rebuild.
- A one-page plain-English summary with a red, amber or green status for each area.
- Findings sorted into material risk, fine for now, and preference. Material risks are ranked by severity.
- Evidence for every finding and a recommended fix your developer can act on.
- A walkthrough of the findings on a call.
Confidence rating
Conditional, 3 out of 5
Verdict: Fix first, then continue.
- 3 findings
Material risk
Fix before launch or before the deal closes.
- 6 findings
Fine for now
Acceptable at current scale. Revisit as you grow.
- 9 findings
Preference
A matter of style or approach. Your call.
How it works
How a review runs.
- 1
Access
We agree scope and one fixed fee in writing. You give me read-only access to the code, a read-only cloud role and a staging environment with seeded data. I change nothing.
- 2
Review
I read the code and run the application and its tests myself. I form my own view from the code, the running system and the configuration before discussing design with your developer. If the material is much bigger or different from what we agreed, I tell you within the first two days, before going further.
- 3
Report
You get the Confidence Report: the verdict, the one-page summary, and every finding with its evidence and a recommended fix.
- 4
Walkthrough
We go through the findings on a call. After the report I can walk your developer through the fixes.
- 5
Follow-up
The Production and Regulated & Investor-Ready tiers include 30 days of follow-up questions. The Regulated & Investor-Ready tier includes a re-check of the critical findings once they are fixed. Remediation is quoted separately if you want help with it.
FAQ
Common questions before booking.
What do you need from me?
Read-only access to the code, a read-only cloud role, and a staging environment with seeded data to run against, plus any architecture documentation you have. I change nothing. Please make sure nothing you share contains production personal data. If something only shows up in production, we agree how it is examined before I look at it.
Will you do the work yourself?
Yes. I run the application and the tests myself, and I do not delegate audit work.
Do you deal with AI-generated software?
Yes. Much of the software I review is built with AI tools, or by agencies using them. It gets the same review as any other codebase, with extra attention to the weak spots those tools tend to produce, such as authentication that only works on the happy path, validation in one layer only, and secrets in the wrong places.
What if you find nothing serious?
Then you get a clean written verdict saying so, with the evidence behind it. That tells you what you can rely on and what to watch as you grow. The fee covers the review, not a number of findings.
What if the answer is rebuild?
If it becomes clear part way through that the answer is rebuild, you choose. I can stop and give you a short written verdict with the evidence and an outline of what to keep and what to replace; the 50% paid on engagement covers the work to that point and there is no further fee. Or we re-scope the remaining days to the rebuild question, such as the approach and what to salvage, at the same fee.
Is it fixed price?
Yes. One fixed fee, agreed in writing before you commit. You pay 50% on engagement and 50% on delivery. If something unexpected changes the scope once work has started, any change is agreed with you in writing before I go further. Remediation is quoted separately.
Do you sign an NDA?
Yes. I'll review and sign yours.
Can you stay on afterwards?
Fractional CTO work is a separate engagement, offered after the review if you want it. It has no bearing on the review or its findings.
Find out what you have before you commit further.
Tell me what was built, who built it and what worries you. I will tell you whether a review fits and which tier, and confirm the scope and one fixed fee in writing.
Book a scoping call