Founders often ask whether an audit is worth it before a funding round or a new hire. Here is what the last twelve turned up.
An audit is a week of me reading your code, running it locally and trying to break the parts that touch money and customer data. The report ranks every finding by risk, not by how interesting it was to find.
The findings that come up every time
Eight of the last twelve had at least one route where a signed-in user could read another customer's record by changing an id in the URL. Usually a controller that used Model::find() instead of scoping the query to the current account. It takes ten minutes to fix and one line in a test to keep fixed.
Seven were sending mail or calling a third-party API inside the web request, which is why their checkout took four seconds. Six had no backups that anyone had ever restored. Five had API keys or a .env file somewhere in their git history, including two live payment keys.
The findings nobody expects
Three had a queue worker that had not been restarted since the last deploy, so jobs were running months-old code. Two had scheduled tasks that silently stopped running when the server was migrated. One had a "temporary" admin login route from 2022 that still worked with a hard-coded password.
None of these are exotic. They happen because a small team is shipping features under pressure and nobody has time to look sideways. That is the whole value of an outside pair of eyes for one week.
What you get at the end
A written report, usually 15 to 25 findings, each with the file, the risk, and a suggested fix. Then a one-hour call with your team to walk through the top five. Most teams fix the critical items within a week, and three clients have asked me back for a follow-up audit six months later.
Comments