Sample Report
What are you paying for?
Every audit results in a comprehensive production readiness report, checked and signed off by an engineer before it reaches you.
Curious what we're actually looking for? See the full breakdown →
Report contents
01
Executive Summary
Verdict, headline risks, and what it will take to become production ready.
02
Architecture & Integrations
A diagram of the app as built: key components, data stores, and every third-party integration in the flow.
03
Category Scorecard
Every category, graded, plus the severity breakdown across all findings at a glance.
04
Findings
Every finding, numbered, with the evidence and reasoning behind it.
05
Remediation Plan
Every fix, prioritized, with realistic effort estimates.
06
Auditor's Opinion
A direct, human-toned verdict on whether to ship - not a hedge.
07
Methodology & Evidence
Exactly what we checked, how, and why.
Sample excerpt
Summary
Fixable, not a rebuild, but not safe for real users yet. No auth checks around user data and a payments flow that double-charges on retry are the two main blockers. Everything else is important but won't prevent going live.
FAuth and access controlany signed-in user can read any user's datacritical
Booking and profile routes trust the session cookie but never check the resource belongs to that user. Any authenticated stranger can page through every guest's contact details and booking history.
est. ~2-4 hrs to fix
C+Data modeldenormalized data, guest details duplicated across bookingslow
Guest name and contact details are copied onto every booking instead of referencing a guests table. No mechanism exists to synchronize this data across bookings when guest details are updated.
est. ~15-45 min to fix
FPaymentswebhooks retry, charges duplicatecritical
The payments webhook handler is not idempotent. When the payment processor retries, the same booking gets charged twice.
est. ~2-4 hrs to fix
FSecuritylive API keys committed to the repohigh
Production API keys are committed in plain text and visible in the repo's history, readable by anyone who's ever had access.
est. ~30-90 min to fix
C-Privacycollects more than it needs, deletes nothingmedium
Signup asks for a full home address that nothing in the app ever uses, and there's no path for a guest to have their data deleted on request.
est. ~1-3 hrs to fix
FTesting0 tests foundhigh
No unit, integration, or end-to-end tests exist anywhere in the codebase.
est. ~1-3 days to fix
B-CI/CDships repeatably, no rollback pathlow
Every push to main builds and deploys automatically but there's no way to revert a bad release short of pushing a manual fix forward.
est. ~15-45 min to fix
DObservabilityconsole.log and hopemedium
Errors only surface if someone happens to be watching server logs when they happen. There's no error tracking, uptime monitoring or alerting anywhere.
est. ~1-3 hrs to fix
C-Maintainabilityone 4,000-line file does most of the worklow
Routing, business logic, and database queries for the entire booking flow live in one 4,000-line file. Any change risks breaking something unrelated due to unnecessary coupling.
est. ~15-45 min to fix
C-Scalabilityevery page load scans the whole bookings tablemedium
The bookings list runs a full, unindexed table scan on every page load. Fine at a dozen bookings, unusable well before a few thousand.
est. ~1-3 hrs to fix
C+Design and UXhalf the flows dead-end on mobilemedium
The date picker and checkout summary overflow the viewport on mobile, and about half the booking flows can't actually be completed on a phone.
est. ~1-3 hrs to fix
Recommended fixes
- 01Properly assert authentication and authorization checks so a signed-in user can only access their own bookings and profile.
- 02Make the payments webhook handler idempotent so retries stop duplicating charges.
- 03Rotate every key sitting in the repo today, then move secrets to Parameter Store.
The rest are in the full report.
Every fix, prioritized, and ready to hand to a developer.
Book an auditOpinion
Do not launch with real payment or user data until the 2 critical findings above are resolved. Safe to reassess once they're fixed.
Know where you stand.
One audit, from $199. A straight answer on what to keep, fix, or rebuild.