Why audit right before sign-off
Once the handover is signed your negotiating position drops to zero: fixes are on your budget from then on. An audit before sign-off is a second pair of eyes while you still hold the lever.
Even a conscientious contractor accumulates technical debt “to make the deadline”. The job is to see it before it becomes yours.
The checklist: 7 points
- 1. Code and access. The repository is yours, the commit history is intact, secrets aren't hard-coded, credentials have been handed over — not left in a developer's inbox.
- 2. Tests. Are there automated tests on the critical logic (payments, authentication)? Zero tests means a regression risk on every future change.
- 3. Security (OWASP Top 10). Injection, access control, password storage, configuration. At minimum static analysis plus a manual review.
- 4. Data-protection law. Do the forms collect personal data? You need a policy, consent capture and storage inside Russia. Otherwise you risk a fine and a block.
- 5. Documentation. How to deploy it, where things live, which environment variables exist. Without it you're hostage to one developer.
- 6. Infrastructure and deployment. How an update ships, whether there are backups and monitoring, what happens at peak load.
- 7. Technical debt and architecture. What won't survive growth, and which decisions were made in a hurry.
What to do with the findings
Not every finding blocks sign-off. Classify them: critical (do not accept), major (into a 30-day plan), minor (into the backlog). What matters is that each one comes with reproduction steps and a clear fix, rather than “this bit is bad”.
That way you end up with a prioritised list of tasks instead of an argument — and you can negotiate with the contractor calmly.
When to bring in outside auditors
If the project cost more than a couple of hundred thousand, is critical to the business, or you're changing contractors, an outside view pays for itself. Your own developer isn't always objective about code they're accepting from a colleague.
Our format is a 2-day technical audit: from $3,700, with a written report, priorities and a 90-day roadmap. If you work with us after the audit, its cost counts towards the next stage.