The code you already run, read by people who could also fix it
A code audit is worth something only if whoever reads it could also repair it. CODEPRESS goes inside the source of software already running, with the eye of someone who might work on it tomorrow: maintainability, libraries carrying published vulnerabilities, secrets and configuration in the wrong place, areas no test protects. Two weeks, a fixed €1,500 to €3,000, and for each problem the repair and its cost in days.
€1,500 – €3,0002 weeks · fixed price
What a code audit is for
The code you run in production today is not what your team wrote three years ago: it has grown one change at a time, often against a deadline, until nobody on the team is quite sure what happens if certain parts get touched. That is nobody's fault: it is the normal trajectory of software that works and keeps growing.
That unease stays vague until someone writes it down: what is genuinely fragile, what is merely inconvenient, what exposes the company to a concrete, checkable risk. The audit takes that diffuse feeling and turns it into a list ranked by severity, each line paired with the recommended fix and an estimate of what it would cost.
What a code audit covers
Quality and maintainability
Duplication, oversized functions and tangled dependencies: we measure what makes every future change slower and riskier than it needs to be.
Known vulnerabilities
We match the third-party libraries you use, version by version, against published vulnerabilities, and tell you which ones actually reach you.
Configuration and exposure
Secrets committed to the repository, permissions granted too widely, settings left at their defaults: problems that start outside the code and get paid for inside it.
Test coverage
What automated tests cover and what they do not, so you know where an urgent change risks turning into an incident.
How a code audit works
Read-only access
All we need is read access to the repository and half an hour of context on what the system does and who uses it.
Analysis
We run static analysis across the whole codebase, then read by hand the parts that carry the most weight: authentication, data, integrations.
False positives removed
We verify every automated finding before writing it down: a report padded with false alarms does not help anyone decide anything.
Report delivery
The finished document moves from our hands to yours over an hour-long call, where we argue about what is worth repairing now, what can wait a quarter, and what is not worth touching at all.
What you get from a code audit
- The problems found, worst first, each with the file and the line to start from
- The dependency inventory with the known vulnerabilities that actually reach you
- The recommended fix for each finding, with an effort estimate in days
- The test coverage map, area by area of the code
- The secrets and exposed configuration found in the repository
- An hour on a call with your team to walk through the report together
When a code audit is not for you
- You already know what to fix and need hands, not a diagnosis: buy the targeted refactor instead of an audit.
- The software exists only as a description: something has to be built before it can be read, and that is what a PoC is for.
- You need a stamp to show a body or a client: this is a technical diagnosis and nowhere does it pass itself off as anything else.
- You want a penetration test against a system in production: that is a different exercise, with a different scope and different tools.
What a code audit costs, and why
Between €1,500 and €3,000 the number follows how much code there is to read: the size of the repository, the languages it is written in, whether a test suite already exists that tells part of the story. Reading by hand is the slow part, and it grows with the codebase.
We agree the price after a first look at the repository and then leave it alone, whatever the reading turns up. If the scope genuinely widens, that conversation happens before we go on, never once the report is delivered.
Code audit: frequently asked questions
- How much does a code audit cost?
- Between €1,500 and €3,000, at a fixed price agreed before we start. Where the figure lands inside that range depends on the size of the repository and the number of languages involved, and it does not change once it is set, whatever the work turns up.
- How long does a code audit take?
- Two weeks from repository access to report delivery, including the final review call with your team to walk through the findings together. It is a fixed time, communicated before we start, not an estimate that stretches if the code turns out more complex than expected.
- What access do you need?
- Read-only access to the repository and half an hour of context on what the system does, who uses it and where it hurts today. We don't need access to production environments, application credentials or real user data: the audit works from the source code alone.
- Does a code audit include a penetration test?
- No. The audit reads the source code, the dependencies and the configuration as written; a penetration test attacks a running system from the outside, with different tools and permissions. The two are complementary but distinct, and the audit neither replaces nor claims to replace the second.
- What do I get at the end of the audit?
- A written report with findings ranked by severity, each one paired with the point in the code where it sits, the recommended fix and an effort estimate in days. To close, an hour on a call with your team to walk through it before deciding where to start.