My independent code audits start from £3,500, and the Production Audit starts from £6,500. Those are the published prices on this site, and the final figure depends on the size and complexity of what's being reviewed. Here's what moves the number and what you get for it.
What drives the price
Three things set the scope, and the scope sets the price.
Size of the codebase. Reading 20,000 lines carefully is a different job from reading 200,000. The tiers on this site are set by depth and what is at stake rather than by a line count. If what you have is much larger or more complex than a tier assumes, I tell you before you commit and confirm one fixed figure in writing.
How many moving parts it has. Repositories, endpoints and third-party integrations each add surface to review. A single web app with one payment provider is a smaller job than a platform with a mobile app, an admin portal and half a dozen external services.
What the system handles. A brochure site with a contact form needs a lighter look than something holding patient records or taking payments. The more damage a failure would do, the more depth the review needs.
The published tiers
These are the "from" prices on the code and architecture review page.
Clarity Audit, from £3,500
For internal platforms, MVPs and early-stage products, when you want to know if it is sound enough to carry on with. Security review, an architecture spot-check and a dependency vulnerability scan, with a written report and a walkthrough call.
Production Audit, from £6,500
For builds going into production, or already handling real users, payments or sensitive data, when the question is whether it is ready for users. A full security, architecture, infrastructure and data-handling review, with developer-ready fix specifications and a phased roadmap.
Regulated & Investor-Ready, from £9,500
For regulated work, high-risk systems and anything an investor will examine. It goes further than the Production Audit and includes a summary written for investors and the board.
If the review is part of an acquisition or investment, the technical due diligence service is priced separately, from £8,000.
"From" means what it says. Once I've seen the size and shape of the system, you get a figure for the work. That figure is the figure.
Why fixed fee
A day rate puts the risk on you. Every extra hour I spend is an hour you pay for, and you have no way to judge whether it was needed. It also nudges the reviewer towards finding more, because more findings justify more time.
A fixed fee for a defined scope reverses that. I have to decide up front what I'll look at, and you know what it costs before it starts. If the code turns out to be in good shape, you still pay the fee, because the fee covers the review and not a minimum number of problems. A clean result is a perfectly good result.
What a cheap automated scan does and doesn't cover
Automated scanners are useful and you should be running them anyway. They check dependencies against lists of known vulnerabilities, flag some common coding mistakes and spot secrets committed to the repository. Many are free or cheap.
What they can't do is understand what your system is meant to do. A scanner can tell you a library is out of date. It can't tell you that any logged-in customer can read another customer's invoices by changing a number in the address bar, because the code is valid and nothing about it looks wrong in isolation. That kind of problem only shows up when someone traces how a request actually moves through the system and asks who is allowed to do what.
It also can't answer the questions a buyer cares about most. Can this be maintained by someone new? Will it hold up when usage doubles? Is the way it's built going to make the next year of features slower and slower? Those take judgement, and they take someone who has seen these patterns fail before.
Use the scanner as a first filter. Don't treat a clean scan as a clean bill of health.
What to ask for a quote
Any reviewer should be able to give you a price once they know a few things: how big the codebase is, how many repositories and integrations are involved, what the system handles, and what you need the answer for. A board decision, an investor, a go-live date and a supplier dispute all need slightly different reports.
If someone quotes without asking those questions, the price is a guess. If they can't tell you what's in the report, you can't compare it against anything.
If you want a view on which tier fits, get in touch with a few lines about the system and I'll tell you honestly whether an audit is what you need.