One week. A clear path forward.
One week. A clear picture of what your product has, what it needs, and what that takes. The plan is yours to keep.
Structure, dependencies, data model, and scalability risks - documented.
Auth flows, exposed endpoints, secrets handling, and injection vectors.
I go through findings with you (and your team if needed) on a recorded call.
Every engagement with me starts here. Before you build the next big feature, hire engineers, commission a rewrite, or close a technical acquisition, you need a clear, honest picture of the codebase. In one week I read every file, map the architecture, run a security pass, audit the dependencies, and deliver a written risk register with plain-English findings and realistic effort estimates. You get a prioritised plan and a 30-minute recorded walkthrough for you and your team. The plan is yours to keep whether we work together afterwards or not, and the fee is credited in full toward any follow-on engagement.
No judgment. Just clarity.
Access & Context Call
DAY 1Read-only repository access, staging environment credentials, and a 30-minute kick-off call. I need to understand what the product does, who built it, and what you are worried about. That context shapes everything.
Architecture Review
DAYS 2–3Data model, service boundaries, API design, authentication flows, state management patterns, and the dependency graph. Documented as a written summary and, where useful, a diagram.
Security & Dependency Pass
DAYS 3–4Authentication and session handling, exposed endpoints without proper authorisation, secrets and environment variable hygiene, SQL injection and XSS vectors, CVEs in dependencies. Every finding rated by severity and exploitability.
Risk Register & Written Report
DAY 5A prioritised list of findings, each one with what it is, why it matters, realistic effort to fix, and recommended action. Plain English. No unnecessary alarm, no padding.
Recorded Walkthrough
DAY 5–6A 30-minute recorded call where I walk through every finding with you and your team. You get the video, the full written report, and a follow-up async Q&A window for any questions that come up after.
Good fit if this is your situation.
- →You run a live B2B SaaS and want a senior engineer's honest read on what it needs to keep growing.
- →You inherited a codebase from a previous contractor, an ex-co-founder, or an agency and you do not know what you have.
- →You are about to make your first engineering hire and want to know what they are walking into.
- →You received an AI-generated prototype and want an independent risk assessment before committing to a rescue.
- →You are evaluating a technical acquisition and need due diligence from an experienced engineer.
- →You have been told the product needs a full rewrite and you want a second opinion before spending six figures.
What I don't do.
- ✗The assessment produces a written plan and a recorded walkthrough. Remediation is a separate engagement.
- ✗Mobile apps (iOS/Android native) are not covered. Web applications, APIs, and backend services only.
- ✗The assessment identifies security risks and compliance gaps; it does not certify SOC 2, HIPAA, or ISO 27001 compliance.
- ✗The assessment fee is non-refundable once the codebase is shared and the review is completed.
Not the right fit?
- ✗Teams that have already decided to rewrite and just want validation. Save the assessment budget for the build.
- ✗Projects where the source code is under NDA and cannot be shared for review.
The assessment fee is credited toward follow-on work.
If we keep working together after the assessment, on a build, a partnership, or a rescue, the fee is applied toward your first invoice. The plan is yours to keep either way.
The Technical Assessment by Suhag Al Amin is a one-week paid engagement and the starting point for working together. It delivers a written risk register, architecture summary, security findings, dependency audit, a prioritised plan, and a 30-minute recorded walkthrough. It is built for B2B SaaS founders and teams who want to know what their product needs next, who inherited a codebase, or who are weighing a rewrite or a technical acquisition. The founder keeps the plan whether or not they continue, and the fee is credited in full toward any follow-on engagement. Web, API, and backend codebases only. Pricing starts from $400. Inquiries: suhag.alamin13@gmail.com or https://cal.com/suhag/intro-call.
Building, growing, or maintaining a SaaS? Let's talk.
A short intro call first. If it is a fit, we start with a one-week Technical Assessment, and the plan is yours to keep either way.