What a technical debt audit actually covers

“A code audit” is one of those phrases that can mean anything from a two-hour phone call to a six-month consulting gig. Here is what it means when we do one, so you can compare apples to apples.

The goal

You should finish an audit knowing three things:

• What will break first, and how badly.
• What it would cost to fix each layer of the problem.
• Which parts are fine and should be left alone.

Notice the third one. A good audit protects working code from the urge to rewrite everything, which is how small problems become failed projects.

What we actually check

The audit is a pass over six areas, in priority order:

1. Security. Known vulnerabilities in your dependencies, injection points, exposed admin surfaces, and how secrets are handled. This comes first because it is the only layer that can end the company.
2. Stability. What happens when the database hiccups, the queue fills, or a third-party API times out. We look for the failure modes nobody has rehearsed.
3. Performance. A baseline, not a makeover: the three slowest endpoints, the worst queries, and whether caching exists at all.
4. Tests. What is covered, what is theater, and what the critical paths would need before anyone dares deploy on a Friday.
5. Deployment. Whether the build runs anywhere besides one laptop, whether rollbacks exist, and whether backups have ever been restored, not just taken.
6. Bus factor. How much of the system lives in one person’s head, and what the runbook would look like if that person won the lottery tomorrow.

What you get

A short report, not a book. Each finding gets a severity, an estimate in hours, and a recommendation that says fix, monitor, or leave alone. You also get a prioritized backlog you can hand to any developer, us included, without another discovery phase.

The hands-on pass usually takes one to two days on a small system, longer on a decade-old monolith. We price it flat and tell you the total before we start.

When you should not buy one

If the app is a few thousand lines with one dependency and you already know the answer, the audit would be theater. For anything bigger, or anything handling payments or personal data, the audit is the cheapest insurance you can buy against the unknown.

If you want to know what an audit would cover in your specific case, describe the system and we will tell you honestly, including when the honest answer is that you do not need one yet.