An independent code audit, in about a week, at a fixed price
Dmitry Nichiporchik, Yarvixo’s CTO, reads your codebase himself for about a week and writes down what he finds: the risks, ranked, with an estimate of what fixing each one costs, and then a call to walk you through the report. An independent code review of the whole system, for the moments the stakes change: due diligence, a handover from an agency or a freelancer, an MVP built fast — or with AI — about to meet real users, or growth.
From $2,500, fixed · about a week · a written report and a call · larger codebases quoted after a look at the repository
- Read access to the repository
- A look, then a fixed price
- About a week of reading
- The report, risks ranked
- A call to walk through it
- The report is yours
What is a code audit?
The short answer, and how it differs from the review your team already does.
A code audit is an independent read of a whole codebase by someone who did not write it and has no stake in defending it. It ends in a written judgement: what in the system is likely to fail, what that would cost when it does, and what it costs to fix first. A code review reads one change before it is merged; an audit reads the system as it stands — the data model, the boundary between customers, the secrets, the tests, the deploy — and asks whether it will hold what the business is about to do to it.
Ours is done by one person, Yarvixo’s CTO, in about a week, at a fixed price from $2,500. What comes back is a report with the risks ranked and an estimate of what fixing each one costs, and a call to walk through it. The same work is also called a source code audit, a code quality audit or a technical audit. A software audit can mean it too, though that phrase also covers licence audits, which this is not.
When you need a code audit
Four moments when somebody is about to rely on a codebase they have not read.
Before technical due diligence
An investor’s or an acquirer’s engineers will read the code anyway. Reading it first puts the risks on your list, with a cost against each, before they are on theirs. If you need someone in the room for the diligence itself, that is a fractional CTO’s work.
Before you take over code
From an agency, a freelancer or a team that is leaving. The handover is the last moment you can still ask the people who wrote it, and taking code over can be cheaper than a rewrite or considerably more expensive. The audit tells you which, before the next contract depends on it.
Before an AI-built MVP meets real users
A first version written fast with AI tools usually works on the path it was demonstrated on. The audit asks what happens off it: the second customer, the request sent twice, the key in the repository, the route that returns someone else’s record. What we look for.
Before you scale
Before money goes into growth, find out which part breaks first. The order is usually readable in the code: state held inside one process, a hot table every request writes to, autoscaling on the wrong signal, deploys that drop live sessions.
What a code audit checks
Six areas, each one argued at length in an article of ours, so you can read the reasoning before you buy it.
Data model and concurrency
Which rules the database enforces and which ones the code only checks. A check followed by a write is racy by construction: two requests both look, both see nothing, both write. We look for the rules the business considers impossible to break that only a validator protects. Preventing double bookings in PostgreSQL.
Tenant isolation
If you sell to companies: is the boundary between customers in the schema, or a filter in a shared helper that a background job, an importer or an admin screen can go around? A missed filter is not a broken page; it is one customer reading another’s data. Multi-tenant architecture from a live SaaS.
Secrets, sign-in and permissions
Keys in the repository or the shipped bundle, who can sign in and from where, and whether every service, user and AI agent can do only what its job needs. If an agent is in the product: what it can reach, and what happens when something it reads carries instructions. AI agent security · a read-only MCP server.
Scaling and load
What breaks first as traffic grows, and whether anyone has measured it: in-process state that stops a service scaling out, write contention on hot tables, autoscaling on CPU when the load is connections, deploys that are visible to users. Architecture at 50,000 concurrent players.
Tests, deploy and infrastructure
Whether the tests cover the paths that move money and data, whether a release can be rolled back, whether the backups have ever been restored, and whether one person’s laptop is quietly part of how the product ships.
Dependencies
Packages that are abandoned or carry known vulnerabilities, versions that float, licences you may not be allowed to ship, and what the upgrade everyone has been putting off now costs.
Auditing AI-generated code and vibe-coded MVPs
What usually goes wrong when code is written faster than anyone reads it.
Code an AI assistant writes is usually right on the path it was asked about. What it misses is what nobody asked about, because it wrote each piece without reading the rest of the codebase — and, often, nobody has read it since. The mistakes are the familiar ones, made faster:
- Authorisation in the interface, not on the server. The button is hidden, but the route behind it answers anyone who calls it, including for a record that belongs to someone else.
- Secrets where they can be read. Keys committed to the repository or shipped in the browser bundle, often with far more access than the feature needed.
- Rules kept only in application code. A check followed by a write, so two requests at the same moment both pass; and a retry that charges, books or sends twice.
- Tenancy added query by query. The customer filter is in every query that was generated together, and missing from the one generated a week later.
- Queries built from strings, and errors swallowed. Input that reaches the database unparameterised, and failures caught and logged where nobody looks.
- Tests that test the code, not the job. Generated to pass against the code as written, so they confirm its mistakes rather than catch them.
- The same thing written five times. Several versions of one helper, because each prompt started fresh, and dependencies added for a line or two that nobody has checked.
None of this makes AI-written code worse than code from a tired team on a deadline; it is the same list. The audit reads it with that list in mind: where the server checks who may do what, where the secrets live, which of the rules the business considers impossible to break the database actually enforces, and where one customer’s data meets another’s. If the answer is that the code should be cleaned up rather than rewritten, the report says where to start.
What you get, and how the week runs
One person, one codebase, one report.
Read access to the repository
The one thing an audit cannot do without: a demo or a description gives you an opinion. Read-only access is enough.
A look, then a fixed price
From $2,500. The price grows with the size of the codebase, so anything above $2,500 is quoted after a look at the repository, before the work starts.
About a week of reading
Dmitry reads the code himself, starting from what you already worry about and from the moment the audit is for.
The report, risks ranked
Written, most serious first, and against each risk an estimate of what fixing it costs. It also says what was read and what was not.
A call to walk through it
The findings argued rather than just read, with you and, if you like, whoever builds the product.
The report is yours
Fix it with your team, with whoever wrote the code, with another company, or with us. Fixing is separate work.
How much does a code audit cost?
One fixed price to start from, and the one thing that moves it.
Our code audit is a fixed price from $2,500, for about a week of Yarvixo’s CTO reading your codebase, the written report and the call. The price grows with the size of the codebase — how much code there is, across how many services and repositories — so anything above $2,500 is quoted after a look at the repository, and you know the number before the work starts.
Fixing is not in that price. The report puts an estimate against each risk so that you can take it to any team. If you want us to do the work, it is quoted separately, like any other build; the bands we quote against are published.
A code audit, a fractional CTO, or consulting?
Three ways to buy senior judgement on a technical problem, and when each is the right one.
| Code audit | Fractional CTO | AI consulting | |
|---|---|---|---|
| You buy | A written judgement on one codebase | A technical leader, part of the month | Answers to specific questions |
| Price | Fixed, from $2,500 | $100 an hour, billed monthly | $100 an hour, no minimum |
| Lasts | About a week | As many months as it is useful | Until the answer is clear |
| Right when | A decision is about to rest on code nobody independent has read | Decisions need owning, but not full time | One question decides the money |
If the report shows the code needs someone senior watching it for months rather than reading it for a week, that is a fractional CTO; if one question about an AI feature decides the money, it is AI consulting.
What a code audit is not
Said plainly, because each of these is sold under a similar name.
Not a penetration test
Nobody attacks your running system. The audit reads the code and its configuration, so the security findings are the ones a reader can see: secrets, authorisation checked in the browser but not on the server, queries built from strings, permissions wider than the job. If the product needs a penetration test, the report says so.
Not a smart contract audit
Solidity is read as part of the system — what sits on-chain, what does not, and who may call what. A contract that will hold other people’s money on mainnet should also go to an independent audit firm, which our smart contracts page recommends too.
Not a compliance certificate
No SOC 2, ISO 27001 or other sign-off comes out of it, and nothing in it is certified. It tells you what is in the code.
Not a guarantee
A week of reading finds what a week of reading can find. That is why the report says what was read and what was not, rather than implying it covered everything.
Who reads your code
One named person, the same one accountable for the figures this site leads with.
Dmitry Nichiporchik is Yarvixo’s CTO, and the audit is his from the first read to the call. He is accountable for the multiplayer backends behind 52,000 peak concurrent players at 62 ms average latency and 99.98% uptime, and behind Metarun, which peaked at 39,000. He built and runs ArendaOS, Yarvixo’s own multi-tenant SaaS, which is where the checks above for tenancy and for rules the database enforces come from.
The subjects he is the reviewer of record for are authoritative multiplayer in Go with gRPC and Redis, scaling connection-bound services on Kubernetes with KEDA, the on-chain boundary in Solidity on BNB Chain, multi-tenant SaaS on PostgreSQL and NestJS, retrieval and LLM evaluation, and the client side in Unreal Engine and Unity. Every article this page links to carries his byline, so you can read how he argues before you pay for a report.
And reading code someone else wrote is not new to Yarvixo. King’s Bounty II is 1C Entertainment’s Unreal Engine 4 game; the Switch port our team shipped found every gigabyte it needed in how the game was built, not in what was in it.
Common questions
What people ask before they give us read access.
Tell us what the code is, and what is about to happen to it
Due diligence, a handover, launch or growth: the moment decides where the reading starts. A fixed price from $2,500; above that, quoted after a look at the repository.
- 1 business dayWe review your enquiry and reply.
- A lookAt the repository, then a fixed price from $2,500.
- About a weekThe report, risks ranked, and a call to walk through it.
Message received
We’ll review your enquiry and respond within one business day.