One week. A clear path forward.
One week. You will know exactly what you have, what is broken, and what it will take to fix it.
Structure, dependencies, data model, and scalability risks - documented.
Auth flows, exposed endpoints, secrets handling, and injection vectors.
I go through findings with you (and your team if needed) on a recorded call.
Before you commission a rewrite, hire engineers, or close a technical acquisition, you need one thing: the truth about the codebase. In one week I read every file, map the architecture, run a security pass, audit the dependencies, and deliver a written risk register with plain-English findings and realistic effort estimates. No developer politics, no agenda, no rant about the previous engineer. Just a clear, honest picture of what you are working with — and a 30-minute recorded walkthrough that you and your team can watch together. The audit fee is credited in full toward any subsequent build engagement.
No judgment. Just clarity.
Access & Context Call
DAY 1Read-only repository access, staging environment credentials, and a 30-minute kick-off call. I need to understand what the product does, who built it, and what you are worried about. That context shapes everything.
Architecture Review
DAYS 2–3Data model, service boundaries, API design, authentication flows, state management patterns, and the dependency graph. Documented as a written summary and, where useful, a diagram.
Security & Dependency Pass
DAYS 3–4Authentication and session handling, exposed endpoints without proper authorisation, secrets and environment variable hygiene, SQL injection and XSS vectors, CVEs in dependencies. Every finding rated by severity and exploitability.
Risk Register & Written Report
DAY 5A prioritised list of findings — each one with: what it is, why it matters, realistic effort to fix, and recommended action. Plain English. No unnecessary alarm, no padding.
Recorded Walkthrough
DAY 5–6A 30-minute recorded call where I walk through every finding with you and your team. You get the video, the full written report, and a follow-up async Q&A window for any questions that come up after.
Good fit if this is your situation.
- →You inherited a codebase from a previous contractor, an ex-co-founder, or an agency and you do not know what you have.
- →You are about to make your first engineering hire and want to know what they are walking into.
- →You received an AI-generated prototype and want an independent risk assessment before committing to a rescue.
- →You are evaluating a technical acquisition and need due diligence from an experienced engineer.
- →You have been told the product needs a full rewrite and you want a second opinion before spending six figures.
What I don't do.
- ✗The audit produces a written report and a recorded walkthrough — remediation is a separate engagement.
- ✗Mobile apps (iOS/Android native) are not covered — web applications, APIs, and backend services only.
- ✗The audit identifies security risks and compliance gaps; it does not certify SOC 2, HIPAA, or ISO 27001 compliance.
- ✗The audit fee is non-refundable if the codebase is shared and the review is completed.
Not the right fit?
- ✗Teams that have already decided to rewrite and just want validation — save the audit budget for the build.
- ✗Projects where the source code is under NDA and cannot be shared for review.
The audit fee is credited toward a build engagement.
If you decide to continue with a full MVP build or rescue after the audit, the audit cost is applied toward your first invoice. You get the clarity either way.
The Codebase Audit by Suhag Al Amin is a one-week engagement that delivers a written risk register, architecture summary, security findings, dependency audit, and a 30-minute recorded walkthrough. It is designed for founders who inherited a codebase, are evaluating a technical acquisition, or want an independent assessment of an AI-generated prototype before committing to a rescue engagement. The audit fee — from $1,500 USD flat — is credited in full toward any subsequent MVP build or rescue project. Web, API, and backend codebases only. Inquiries: suhag.alamin13@gmail.com or https://cal.com/suhag.
Have a pilot deadline? Let's talk.
Tell me where you are. I'll tell you, honestly, whether 6-8 weeks is realistic and what the first week looks like.