Codebase Health Check
In 7–10 working days, a senior engineer reviews your code, database and AWS. You get a ranked list of what is risky, what is slow and what to fix first, with a fixed price for each top fix.
Who it is for
Founders, CTOs and agencies with a product in production or about to launch: teams whose developers left, whose AI-built app is about to take paying users, or whose product got slow.
When to call us
- Your developers or agency left
- An AI-built app is about to take paying users
- The product got slow, or there was an incident
- A customer or investor is asking security questions
- A funding round or a senior hire is coming, and you want to know what you have
What you get
A written report that leads with the database, performance, AWS and the fix plan. Every finding has a severity, an effort estimate and a recommended fix. The 30/60/90-day plan gives a fixed price for each of the top three fixes, and a 60-minute readout call walks you through it.
Included
- A 60-minute kickoff call to agree goals and concerns
- A mutual NDA before we see any code
- Read-only access to up to 2 repositories, for example a web app and an API
- Database review: schema, indexes, slow queries and migrations
- Performance hotspots, from your existing logs or monitoring
- AWS and operations: access and permissions, environments, CI/CD, backups and alerting
- Architecture and code structure review
- Security quick-scan: dependencies, secrets in code, auth and permission patterns, and common web vulnerabilities
- Risks typical of AI-written code: duplicated logic, missing tests, unsafe patterns
- Automated scans, with their findings labelled as tool-assisted
- A written report of 8–15 pages, each finding with a severity, an effort estimate and a fix
- A 30/60/90-day fix plan with a fixed price for each of the top three fixes
- A 60-minute readout call
Not included
- Writing the fixes. Each one is quoted at a fixed price, as a separate piece of work.
- Penetration testing, compliance certification (SOC 2, ISO 27001) or a legal opinion on IP
- Load testing or building new monitoring
- Native mobile code review (Flutter or React Native structure only, if asked)
- Production write access, or access to real customer data. A staging copy or the code is enough.
- More than 2 repositories, or a third review round
How it runs
- Kickoff (day 1). We sign a mutual NDA, then agree goals, concerns and access on a 60-minute call.
- Review (days 2–7). Read-only access to the code, the database schema, your AWS account and the logs or monitoring you already have.
- Report and readout (days 8–10). The written report and the 30/60/90-day plan, then a 60-minute call to go through them.
What the report looks like
The report leads with what usually costs the most: the database, performance, AWS and the fix plan. Each finding says what we saw, why it matters, how much effort the fix takes and what we recommend. Findings from automated scanners are marked as tool-assisted, so you can see which ones a person checked.
Access and confidentiality
- Access is read-only and removed when the review ends.
- A staging copy or the code alone is enough. We never need real customer data.
- Our working notes are deleted 30 days after delivery.
The review is advisory and time-boxed. It tells you what to fix and in what order. Writing the fixes is separate work, at a fixed price per item, with us or with your own team.
Common questions
What access do you need?
Read-only access to up to 2 repositories, read-only access to your AWS account, and the logs or monitoring you already have. We sign a mutual NDA first.
We never need production write access or real customer data; a staging copy or the code is enough. Access is removed when the review ends.
What if you find nothing serious?
Then you have it in writing, which helps before a launch, a hire or a funding round. The report still lists what we checked and the smaller items worth fixing, in order. The price is the one agreed at the start either way.
How do you price work?
Every piece of work has a fixed price, agreed in writing before it starts. The Health Check has a published price, and each fix in the plan is quoted separately. We don't bill by the hour.
Prices are in US dollars, and we can quote the equivalent in SAR, AED or TRY.
Do we have to book the fixes with you?
No. The plan is written so your own team can follow it. If you do book fixes with us within 30 days, the Health Check fee is credited against them.
Which tools and stacks do you work with?
Most of all Node.js, TypeScript, PostgreSQL, AWS, Terraform and GraphQL, and also Laravel and PHP, Vue and Nuxt, and Next.js. The review also uses automated scanners, and their findings are labelled as tool-assisted.
Everything runs in your accounts, and you own all of them.
Other services
- Fixed-price fixes
Each item in your Health Check fix plan, quoted at a fixed price agreed before work starts. You choose what to fix. No hourly rates.
Not sure a Health Check is worth it?
Book a free 20-minute call. Tell us what triggered this, and we'll say whether a review would help. If it wouldn't, we'll say that too.
Replies within one working day.