A technical code audit with a remediation plan.
Security, performance, architecture and technical debt. A report both the owner and the developer can understand: what hurts, what it costs to fix and in what order.
A code audit at Tochno is an independent review of your project's security, performance, architecture and technical debt, with a prioritized fix plan. It suits owners who are buying a product, switching contractors or have lost their developer. It starts from UAH 12,000 (up to roughly UAH 25,000) and takes 5–7 days.
When you need a code audit
What we check
Automated tools plus a manual review by an experienced tech lead. Tools find symptoms, a human finds causes.
Quick review or full audit
- Automated analysis
- Review of key modules
- Top 10 risks
- 30-minute call
- Security, performance, architecture
- Every finding with a code example
- Plan with hour estimates
- 60-minute walkthrough with your team
- Everything in the full audit
- Fixing critical and high issues
- Re-check
What a finding in the report looks like
Every finding comes with a file and line, a plain-language explanation of the risk, a fix example and a time estimate.
From access to report in a week
- day 0AccessRead-only repository access, NDA.
- days 1–2AnalysisAutomated tools and architecture review.
- days 3–5Manual reviewKey modules, security, performance.
- days 6–7ReportPDF + walkthrough with your team.
What a technical audit of a website covers
We combine automated tools with a manual review by an experienced tech lead. Tools find symptoms, and a person looks for causes. We focus on Laravel but also analyze other PHP: Symfony, Yii, WordPress plugins and custom-built systems.
An audit is typically needed in four situations: before a purchase or an investment (due diligence), when a developer has left and the code has no documentation, when every fix breaks something else, and before handing the project to a new contractor.
The audit covers four areas:
- security: SQL injection, XSS, CSRF, storage of passwords and keys, access rights;
- performance: slow queries and N+1, caching, queues, server load;
- architecture: structure and dependencies, duplication, adherence to Laravel practices;
- maintainability: PHP, Laravel and package versions, tests, CI, documentation and deployment.
A general explanation of what a code audit is and why you need one is in the article what is a code audit.
What you get in the report
The report has to work for both the owner and the developers. The first page is a summary in plain language, followed by details for the team.
Every finding includes:
- the file and line of code;
- the business risk in plain language;
- an example of the fix;
- an estimate of the hours to fix it, and a priority.
At the end you get a plan with the order of work and a review with your team. You can pass the report to any contractor: that is what it is written for. If there are many recommendations, we help put them in order: what to fix immediately, what in the next sprint, and what can safely wait.
How much does a code audit cost and what affects the price
A code audit starts from UAH 12,000, and for large projects the amount rises to UAH 25,000. An express review costs UAH 12,000, a full audit starts from UAH 18,000. We fix the price after the scope is agreed.
| Factor | How it affects the price |
|---|---|
| Codebase size | More modules mean more hours of manual review |
| Depth of the audit | An express review covers key modules, a full audit looks everywhere |
| Age and condition of the project | Outdated versions and missing documentation make analysis harder |
| Tests and CI | Their absence also becomes a finding |
| Fixes needed | The "audit + fixes" package starts from UAH 35,000 |
If you want us to fix what we find as well, a fix package is billed at $20–35 per hour. All prices are on the pricing page.
How the audit works
From access to the report takes roughly a week. On day zero you provide read-only access to the repository and we sign an NDA. The first two days go to automated analysis and an architecture review. Another three days are spent on a manual review of the key modules, security and performance. At the end you get a PDF and a review with the team.
Production access is not needed, and work with the code is done under an NDA. For performance analysis we ask for a database dump without personal data.
When a code audit is not what you need
A code audit answers a question about the state of a project, but that is not always what you need.
- You do not know where exactly the store breaks and want to see the bugs through a customer's eyes. An e-commerce QA audit is better here: from UAH 6,000 in 3–5 days.
- You need a check of every release. Choose website testing or test automation.
- You need a single decision: which stack to pick or how to evaluate a contractor. A 90-minute tech lead consultation for UAH 3,000–4,000 fits.
- You want to build something new rather than assess the old: see Laravel development.
We explained when to bring in a tech lead in the article when you need a tech lead.
What makes our audit different
We do not hand over raw tool output. Every finding is verified manually and explained so that a non-technical person understands the business consequences. Each issue has a time estimate for the fix, so you see the budget immediately. We also look separately at speed; how it relates to users is covered in the article Core Web Vitals for store owners.
To order an audit or clarify the scope, fill in the brief and include the repository or the site.
Do you need production access?
No, read-only access to the repository is enough. For performance analysis, a database dump without personal data is preferable.
Do you audit only Laravel?
Any PHP: Symfony, Yii, WordPress plugins, custom-built systems.
Can a non-technical person understand the report?
Yes. The first page is a summary for the owner, followed by details for developers.
Can I show the report to my contractor?
Of course, that is what it is written for.
How much does a code audit cost?
A code audit starts from UAH 12,000 and, for large projects, goes up to roughly UAH 25,000. An express review is UAH 12,000, a full audit is from UAH 18,000, and an audit with fixes is from UAH 35,000. The price depends on the size of the code.
How long does a code audit take?
Usually 5–7 days from receiving access to the finished report. The first days go to automated analysis, then a manual review of key modules, security and performance, and at the end a PDF report and a review with your team. Timelines can shift slightly depending on project size.
How is a code audit different from a QA audit?
A code audit looks inside: code, security, architecture and performance, and starts from UAH 12,000. A QA audit looks from outside, through the customer's eyes: whether payment, cart and the mobile version work, and starts from UAH 6,000. If you are unsure which to choose, start with the free express check.
What do I need to provide for a code audit?
Read-only access to the repository, a signed NDA and a contact person who knows the project and can answer the audit team's questions. For performance analysis, a database dump without personal data is preferable. Production access is not needed.
Tell us about your project.
We reply within 2 business hours. An estimate with a price and timeline range follows within 1 day.