Code & architecture review
Independent code and architecture review.
We examine your code and architecture under NDA, including defined security checks, and deliver a prioritised report with specific fixes.
Review scope
What the review covers, and what it does not.
Four areas, each with a defined set of checks. We are precise about scope, so you know what the report does and does not tell you.
Architecture
- Module and service boundaries, coupling and dependencies
- Data model, schema design and shared data between components
- API design and contracts between services
- Database query patterns and performance hot spots
- Scalability limits and fit with your non-functional requirements
Reliability
- Error handling, retries and timeouts
- Idempotency of jobs, messages and payments
- Failure modes of external dependencies
- Transactions and data consistency
- Deployment, configuration, rollback and logging
Maintainability
- Code smells, duplication and complexity hot spots
- Structure, naming and readability
- Test coverage of critical paths
- Outdated dependencies and frameworks
- Technical debt, ranked by cost of change
Security checks
- Common vulnerability classes (OWASP Top 10)
- Authentication, authorisation and access-control logic
- Secrets in code, configuration and git history
- Known-vulnerable dependencies
- Error handling and logging of sensitive data
Automated tooling (static analysis, secret and dependency scanning) plus manual review of the critical paths. Security checks follow an OWASP ASVS-based checklist.
Not included
- Penetration testing
- Formal security audits or certification
- Compliance assessments (ISO 27001, SOC 2, PCI DSS, NIS2, GDPR)
- Infrastructure and cloud configuration review, unless agreed in scope
- Load testing or testing against live systems
- UI, UX and accessibility review
- Implementing the fixes (available as follow-up work)
- Any guarantee that a system is free of defects or vulnerabilities
If you need a penetration test, audit or compliance assessment, we can recommend a specialist.
Process
How a code review works: three steps.
Sign NDA
Source code and documentation stay confidential. Access is read-only.
Static analysis + manual review
Automated tooling finds the obvious. Manual review finds what matters. An optional team interview adds context.
Prioritised report
Findings ranked high, medium and low, each with a specific fix.
Deliverable
What you receive: a prioritised report.
Every finding has a risk level, a location in the code and a concrete recommendation.
The sample describes a fictional system and shows the report format only.
Timeline & fee
Typically 3 to 7 working days.
Scope and fee are set after a short look at the repository: size, complexity and dependencies.
| Scoping | Short call and a first look at the repository. You receive a fixed-fee proposal. |
|---|---|
| Duration | Most reviews take 3 to 7 working days. Larger systems are scoped individually. |
| Input | Source code, documentation (requirements, epics), git repository access |
| Output | Prioritised report: high / medium / low, with specific fixes, plus a walkthrough call |
| Follow-up | Optional. Implementation of fixes, or ongoing technical guidance |
Questions
Code review questions.
What do you need from us?
Read-only access to the repository or an archive of the source, plus any documentation you have: functional and non-functional requirements, epics, architecture notes. Less documentation is fine; we work with what exists.
Is our code kept confidential?
Yes. We sign an NDA before receiving anything. Source and documents are used only for the review.
Is this a security audit or a penetration test?
No. The review includes defined security checks for common vulnerability classes, but it is not a penetration test, a formal audit or a compliance assessment. If you need one, we can recommend a specialist.
Do you change our code?
No. A review produces a report. Fixes can follow as separate work if you want us to implement them.
Which languages and stacks do you review?
We have worked extensively with Java (Spring Boot, Java EE), C# (.NET Core), Python, PHP and React, on PostgreSQL, Oracle, MongoDB, Redis and RabbitMQ, and with platform tools such as Airflow, Superset and Keycloak. If your stack is different, tell us and we will say whether we are the right reviewer.
Can you speak to our developers?
Yes. A short team interview is optional and often helps with context on past decisions.
How is it priced?
A fixed fee, agreed before work starts. We set it after a short look at the repository: its size, complexity and dependencies.
Ready to scope a review?
Send us a short description of the system and your concerns. We reply within one business day.