A technical audit,
scheduled by the hour.
We publish the whole process. What happens at 09:00, what at 13:00, what lands at 17:30 on day two. The price is fixed and the scope agreed in advance. If something won't fit into two days, we say so before the contract is signed.
Three typical situations.
Almost every audit comes down to one of the three reasons below — occasionally just to gauge the state of the system with no particular trigger.
You inherited the code
You let the contractor go. Before sign-off you need a second pair of eyes: what you've inherited and what it costs to put right.
You've hit the growth ceiling
You're growing, but releases are rare, servers cost more and the technical debt is felt. You need a map: what to rewrite and what to retire.
A regulator is asking
An inspection is coming, or a tender with a security section, or a client is demanding a pentest. You need an independent outside assessment, not your own team's verdict.
A map of the system. Surface scanning. A daily summary by 17:00.
Kick-off call
A 30-minute video call. NDA signed → read-only access handed over → scope recorded in the shared chat. Anything outside the scope is flagged explicitly.
scope.mdEnvironment snapshot
We clone the repository, take a read-only dump of the database schema and record version-locked artefacts (lockfile, env names). Nothing in production is changed.
artifacts.zip · kept for 14 days, then deletedArchitecture walkthrough
Your CTO or lead walks us through the system on a call. We record it for the team (with your consent). We're working out why decisions were made, not judging them.
architecture-notes.mdStack inventory
Versions, licences, end-of-life dependencies, deprecated APIs. We run npm audit, snyk, license-checker and a CVE vulnerability scan.
stack-inventory.csvLunch
A break. The servers carry on scanning without us.
OWASP Top 10 sweep
A01 broken access · A02 cryptographic failures · A03 injection · A04 insecure design · A05 misconfiguration · A06 vulnerable deps · A07 auth · A08 software integrity · A09 logging · A10 SSRF. Half automated probes, half manual code review.
owasp-day1.mdData-protection checklist
Where personal data is stored. Which consents you collect. The processing policy. The operators' register. The notification to the regulator. Cross-border transfers.
fz152-checklist.mdDaily summary
Everything found that day goes into the shared chat, split into critical / high / medium / low. A 10-minute check-in with your CTO on whether anything urgent needs acting on outside the audit.
day1-summary.mdDeep probes. Report assembly. A walkthrough call by 18:00.
RLS / DB security
We check every row-level security policy. Indexes, secrets, keys. Test cases: anon → admin table must be false; owner → another owner's data must also be false. Run across the roles × tables matrix.
rls-matrix.csvInfra & deploy
CI/CD pipeline. Secret management. Backups (RPO/RTO). Monitoring and alerting. SLOs. Backup retention. Disaster recovery — whether a plan exists and how well thought through it is.
infra-notes.mdLunch
A break.
Performance probes
Core Web Vitals on the key pages. TTFB. Heavy endpoints. Queues. N+1 queries. Not load testing (k6 / Locust) — that's a separate package.
perf-report.mdCost & ops review
Server bills. Optimisations (we usually find 15–30% of savings). Observability — what you can see and what you can't. Whether an ops runbook exists.
cost-review.mdAssembling the PDF report
Every finding into a severity × effort × impact matrix. 30+ pages. An Excel register for import into Jira / Linear. A roadmap proposal (optional).
audit-{your-product}-2026-XX-XX.pdfWalkthrough call
The PDF goes out an hour before the call so you have time to read it. We go through the critical findings, answer questions and send the recording. The audit is closed.
call recording · PDF · Excel registerDelivered by 18:00 on day two.
Four artefacts. One price. The full report is included, with no surcharge for an extended version.
PDF report
30+ pages. Severity × effort × impact. Specific lines of code and the commands to reproduce. On our letterhead.
Excel register
Every finding in one table. Filters by severity / effort / category. One-click import into Jira / Linear / Notion.
30-minute walkthrough
A video call after the PDF lands. We go through the critical findings. The recording and transcript are yours.
Roadmap (optional)
If you ask, a separate document: a remediation sprint, a retainer proposal, or a full-rebuild scenario.
The boundaries are set.
So expectations don't diverge. Every item below is either a separate package of work or another studio's speciality.
- ×We don't fix the vulnerabilities. That's a separate sprint.
- ×We don't pentest production. Read-only review only. Active pentesting is a separate package.
- ×We don't do load testing (k6 / Locust).
- ×We don't talk to your customers or users.
- ×We don't sign NDAs with third parties without agreeing it first.
- ×We don't deliver the report in Word — PDF only (so it can't be edited).
The audit creates no obligation.
You can take the report and carry on by yourself. You can carry on with us in one of three formats. You can hand the report to another contractor — it's written to be readable by an outside team.
Remediation sprint
We take the priority critical and high findings from the report. Fixes with tests. A pull request into your repository.
Retainer
A permanent pair of senior hands on the product. Two-week sprints. No hidden hours.
Full rebuild
If the report showed that rewriting is cheaper than fixing, we rebuild the product on our stack standard.
The audit log.
A real fragment. The client name and paths are redacted.
# ─── DAY 1 · 13:04 · OWASP Top 10 sweep ───studio audit owasp --scope=api,web --target=████████.comscanning 247 endpoints · 1342 functions · 12,847 LOC[A01] broken access — 2 endpoints with no auth middleware · /api/internal/*[A02] crypto — bcrypt cost=8 (we recommend 12) · 1 place[A03] injection — 0 SQLi · 1 NoSQL filter without sanitising[A05] config — Supabase service_role key in the client bundle · CRITICAL12 findings · 1 critical · 3 high · 6 medium · 2 lowstudio audit owasp --export > owasp-day1.md✓ owasp-day1.md · 4.7 KB · pushed to /shared/audit-2026-05-28/