AUDITCODE AUDIT
Technical Audit of a Laravel B2B Project.
Review of a contractor's code before renewing the contract: architecture, security, queries.
An audit under NDA: we do not publish the client name, code or screenshots. The code on the cover illustrates a typical issue; it is not the client's code.
- TYPE
- AUDIT
- TIMELINE
- 2 weeks
- TEAM
- Tech lead (PHP), QA
- SERVICE
- Code audit
01
Task
The client had to decide whether to renew the contract with their contractor, so we assessed the quality of the B2B project's Laravel code. The complaints were typical: report pages loaded slowly, new features broke old ones, and the contractor's estimates kept growing.
02
Constraints
- [WARN]Access to the repository and a database copy only, no production servers
- [WARN]The verdict was needed before the contract renewal date
- [WARN]The report would be read by a non-technical owner: a jargon-free summary was required
03
Solution
We ran a technical audit covering architecture, security and query performance, found 312 N+1 queries and gave 14 recommendations. Each recommendation has a priority, an hours estimate and the risk of not doing it.
ArchitectureModule structure, business logic in controllers, duplication, test coverage.
SecurityAuthorization, input validation, mass assignment, vulnerable dependencies.
Database queriesProfiling key pages: N+1, missing indexes, heavy reports.
A report to decide onA summary for the owner and 14 prioritised recommendations for developers.
04
Stack
Laravelproject codePostgreSQLqueries and indexesLaravel Debugbar, TelescopeprofilingPHPStanstatic analysiscomposer auditvulnerable dependencies
05
Results in numbers
N+1 QUERIES312
RECOMMENDATIONS14
N+1 is the number of redundant repeated queries found by profiling key pages.
06
What we would do differently
01We would ask for production log access on day one: some slow scenarios only show up on real data.
02We would meet the contractor at the start of the audit, not the end: some decisions had historical reasons.
03We would give hour ranges for the recommendations in the first version of the report.
NEXT CASELanding Page with Telegram and CRM Form
DEMO