Read-only access
Read-only repository and infrastructure access; NDA in place before any code is touched.
Consulting
Codebase Audit.
An outside read on your stack from senior engineers — architecture, security, performance, and operational risk — delivered as a written report plus a walkthrough.
Full-stack codebase and security review with a written report and a 60-min walkthrough.
What you get.
Every deliverable below is included in the scoped engagement — no upsell at handoff.
Architecture reviewAn outside read on your system design, key boundaries, and the trade-offs you've inherited.
Security reviewOWASP-aligned check of auth, data handling, input validation, dependencies, and infrastructure exposure.
Performance readThe top opportunities for latency and cost reduction — backed by measurement, not opinion.
Operational riskDeploy story, observability, on-call readiness, and the bus-factor risks worth fixing.
Written reportA 20–30 page PDF with findings, severity, evidence, and recommended remediation.
60-minute walkthroughA live session with your engineering team to talk through findings and answer questions.
How it works.
The same four-step flow we use across every engagement, scoped to this gig.
Audit
Senior engineers spend 3–4 days reading code, running tools, and probing for issues.
Write up
Findings drafted into a single report with severity and evidence for each.
Walkthrough
60-min session with your team plus written answers to follow-up questions.
Tools we use.
The stack we default to for codebase audit work. Always open to fitting yours.
Semgrep
Snyk
Trivy
OWASP ZAP
manual review
tracing tools
Why work with us on this.
Three reasons clients pick Hepha Works for codebase audit.
Senior practitioners only
The person who scopes the work is the person who delivers it. No invisible subcontractors, no junior handoffs.
Written scope, fixed price
You see a written scope and a number before any work starts. No timesheet surprises, no scope-creep arguments.
Honest read on outcomes
We won't say it'll work if we don't think it will. If the gig isn't right for your situation, we'll tell you that on the call.
Frequently asked.
The questions we get most before kicking off codebase audit engagements.
Is this a penetration test?
No — this is a code and architecture audit. We can recommend pentesting partners if needed.
Will you fix what you find?
The audit doesn't include implementation. We can scope a remediation engagement separately.
What seniority does the audit?
Senior engineers only — 10+ years building and operating production systems.
Can you handle technical due diligence for an acquirer?
Yes — tech DD for acquirers is a frequent use case. We'll structure the report for that audience.
Will you compete with our existing team?
No — the audit is explicitly an outside read, not a replacement. Reports are written to be useful to your team, not to flatter us.
Related engagements.
Other gigs that pair well with Codebase Audit.
Ready to start?
Send a brief and we'll come back with a written scope and a number within 1–2 business days.