[{"data":1,"prerenderedAt":249},["ShallowReactive",2],{"\u002Fglossary\u002Fwhat-is-a-code-audit\u002F":3},{"id":4,"title":5,"author":6,"body":10,"category":224,"createdAt":225,"description":226,"extension":227,"meta":228,"navigation":234,"ogImage":235,"path":236,"relatedServices":237,"relatedTerms":240,"seo":244,"shortAnswer":245,"stem":246,"term":247,"updatedAt":225,"__hash__":248},"glossary\u002Fglossary\u002Fwhat-is-a-code-audit.md","What is a Code Audit?",{"name":7,"social":8},"Simon Dziak",{"twitter":9},"@SzymonDziak",{"type":11,"value":12,"toc":215},"minimark",[13,22,27,67,71,102,106,132,135,139,153,157,160,192],[14,15,16,17,21],"p",{},"A ",[18,19,20],"strong",{},"code audit"," is a one-off review of an app's source code and setup by someone outside the team that built it. The goal is to find out what state the app is really in: what could leak data, what breaks with real users, what costs more than it should, and what will be hard to change later. The audit itself doesn't change the app. It ends in a written report, and fixing what it finds is a separate step, even when the same team does both.",[23,24,26],"h2",{"id":25},"what-a-code-audit-checks","What a Code Audit Checks",[28,29,30,37,43,49,61],"ul",{},[31,32,33,36],"li",{},[18,34,35],{},"Security and access."," Sign-in and roles, whether one user can read or change another user's data, database rules such as Firebase security rules or Supabase row-level security, and secret keys shipped to the browser or committed to the repository.",[31,38,39,42],{},[18,40,41],{},"Critical flows."," Payments that charge but never unlock the account, webhooks that can run twice or not at all, and sign-up or checkout steps that fail quietly.",[31,44,45,48],{},[18,46,47],{},"Build and deploy."," Whether someone other than the original developer can build, test and release the app from the repository alone.",[31,50,51,54,55,60],{},[18,52,53],{},"Maintainability."," Tests, outdated dependencies, duplicated code and missing documentation: the ",[56,57,59],"a",{"href":58},"\u002Fglossary\u002Fwhat-is-technical-debt\u002F","technical debt"," that slows every later change.",[31,62,63,66],{},[18,64,65],{},"Cost."," Cloud services, scheduled jobs and database reads that drive the bill. This part is often a separate cost audit of the cloud setup rather than the code.",[23,68,70],{"id":69},"when-you-need-a-code-audit","When You Need a Code Audit",[28,72,73,84,90,96],{},[31,74,75,78,79,83],{},[18,76,77],{},"Before you take over an app"," from another developer or agency, so you know what you're inheriting. Pair it with an ",[56,80,82],{"href":81},"\u002Fglossary\u002Fwhat-is-an-app-handover\u002F","app handover",", which moves the code and accounts to you.",[31,85,86,89],{},[18,87,88],{},"Before launch",", especially for an app built quickly or with AI tools such as Lovable, Bolt or Cursor that works in the demo but hasn't met real users.",[31,91,92,95],{},[18,93,94],{},"When something feels wrong",": a security scare, a bill that keeps growing, or bugs that come back after every fix.",[31,97,98,101],{},[18,99,100],{},"Before you buy, invest in or rebuild"," an app, to decide whether to keep the code or start again.",[23,103,105],{"id":104},"what-a-good-audit-report-includes","What a Good Audit Report Includes",[28,107,108,114,120,126],{},[31,109,110,113],{},[18,111,112],{},"The scope",": what was checked and, just as important, what wasn't.",[31,115,116,119],{},[18,117,118],{},"Each finding with evidence",": where it is in the code, how to reproduce it, and why it matters.",[31,121,122,125],{},[18,123,124],{},"A severity ranking",", so the riskiest problems are fixed first.",[31,127,128,131],{},[18,129,130],{},"A suggested fix"," for each finding, or a quote for fixing them.",[14,133,134],{},"Our advice: an auditor should only need read-only access, such as a repository invite and a test login, and should never need production passwords or your users' data.",[23,136,138],{"id":137},"code-audit-vs-code-review-vs-penetration-test","Code Audit vs Code Review vs Penetration Test",[14,140,141,144,145,148,149,152],{},[18,142,143],{},"Code review"," happens on every change, usually by a teammate, before the change is merged. ",[18,146,147],{},"A code audit"," looks at the whole app at one point in time, usually by someone outside the team. ",[18,150,151],{},"A penetration test"," attacks the running app the way an attacker would, usually without starting from the code. An audit finds problems a penetration test can miss, such as a rule that is wrong but hasn't been exploited yet, and a penetration test can find problems in setup the code doesn't show.",[23,154,156],{"id":155},"code-audits-at-app369","Code Audits at App369",[14,158,159],{},"App369 runs fixed-price audits. Each page lists its scope, price and delivery time before you pay:",[28,161,162,170,177,184],{},[31,163,164,165,169],{},"The ",[56,166,168],{"href":167},"\u002Ffixed-price\u002Ffirebase-security-rules-audit\u002F","Firebase Security Rules Audit"," tests whether one user can read or change another customer's data, using an emulator test suite on test data only. You get a report ranked by severity and a pull request that fixes the rules.",[31,171,164,172,176],{},[56,173,175],{"href":174},"\u002Ffixed-price\u002Fai-app-rescue\u002F","AI-Built App Rescue"," starts with a Launch Check of sign-in, data access, payments and deploy for apps built with AI tools. Access is read-only, and the report ranks each issue by severity, with evidence, and gives a fixed quote for the Rescue Sprint that fixes the worst of them.",[31,178,164,179,183],{},[56,180,182],{"href":181},"\u002Ffixed-price\u002Ffirebase-cost-audit\u002F","Firebase Cost-Cut Audit"," measures where a Firebase or Google Cloud bill goes, with read-only access, and ranks the savings by dollars a month and risk.",[31,185,186,187,191],{},"For one known problem, the ",[56,188,190],{"href":189},"\u002Ffixed-price\u002Fflutter-firebase-bug-fix\u002F","App Fix Ticket"," starts with a diagnosis of the root cause, with evidence.",[14,193,194,195,199,200,204,205,209,210,214],{},"Want a first look for free? The ",[56,196,198],{"href":197},"\u002Ftools\u002Ffirebase-rules-checker\u002F","Firebase rules checker"," and the ",[56,201,203],{"href":202},"\u002Ftools\u002Fsupabase-rls-policy-checker\u002F","Supabase RLS policy checker"," flag common access mistakes, such as public paths and sign-in-only checks, in rules you paste in. Both run in your browser. Not sure which audit fits? The ",[56,206,208],{"href":207},"\u002Ftools\u002Ffixed-price-offer-finder\u002F","fixed-price offer finder"," matches your problem to an offer, or ",[56,211,213],{"href":212},"\u002Fcontact\u002F","contact us",".",{"title":216,"searchDepth":217,"depth":217,"links":218},"",2,[219,220,221,222,223],{"id":25,"depth":217,"text":26},{"id":69,"depth":217,"text":70},{"id":104,"depth":217,"text":105},{"id":137,"depth":217,"text":138},{"id":155,"depth":217,"text":156},"Business","2026-10-24T14:00:00.000Z","What is a code audit? What an app audit checks, when you need one, what a good audit report includes, and how it differs from a code review or a penetration test.","md",{"readingTimeStats":229},{"text":230,"minutes":231,"time":232,"words":233},"4 min read",3.45,207000,690,true,null,"\u002Fglossary\u002Fwhat-is-a-code-audit",[238,239],"\u002Fservice\u002Fconsultations\u002F","\u002Fservice\u002Fongoing-maintenance\u002F",[241,242,243],"what-is-technical-debt","what-is-an-app-rescue","what-is-an-app-handover",{"title":5,"description":226},"A code audit is an independent review of an app's source code and setup, by someone who did not write it, to find security holes, broken flows, cost leaks and maintenance risks, and to report them with evidence so the owner knows what to fix first.","glossary\u002Fwhat-is-a-code-audit","Code Audit","ARbG90vbbvZEb5WEDQ0UBin66-ZrCxLdvfJXSArhhv8",1792873309317]