You can ship a codebase you don't understand. You can't run a business on one.
A fixed-price technical audit of your platform - architecture, security, data model, and the specific failure patterns that show up in AI-generated code.
You get a written report, severity-rated findings, and a roadmap you can act on. Whether or not you work with me afterwards.
AI made code generation cheap. It did not make judgement cheap.
Most founders I speak to don't have a technology problem. They have a visibility problem. Something got built - quickly, often well - and nobody can now say with confidence what's underneath it.
Sometimes that's because an agency built it and the architecture lives in someone else's head. Increasingly it's because AI wrote most of it across a series of sessions, each one reasonable on its own, and nobody has gone back to check what the whole thing adds up to.
The symptoms are consistent. Nobody can explain what half the codebase does. Changes that should take an hour take three days. You're not sure whether your database is actually locked down. You're about to hire a developer, or sign an agency contract, or take money from an investor, and you're being asked questions you can't answer with evidence.
That uncertainty is itself the signal. The time to bring structure to an AI-accelerated codebase is while you can still reason about it.
An independent assessment of whether what you own will hold
Not a code review. Not a penetration test. Not a sales exercise dressed up as diagnostics.
An independent, fixed-price assessment of whether what you own will hold - and what it would take to make it hold. I read the repository, the database, the deployment setup and the documentation, and I write down what I find, rated by severity, with the work needed to fix it.
The output is a document your developer can act on and your investor can read.
Two things it deliberately is not. It isn't a pitch: the roadmap is yours to take anywhere, including to another developer. And it isn't a hundred pages of tooling output. Automated scanners produce noise; the value is in the judgement about which findings actually matter for your business, at your stage, and in what order.
Twelve domains, delivered over one to two weeks
These six surface the most critical issues in an AI-built codebase.
Project structure and codebase organisation
Folder structure and separation of concerns, secrets committed to the repo, README and setup documentation, dead code left from generation, .gitignore completeness.
React and frontend code quality
Component scoping, state management, duplicate logic across components, useEffect dependency correctness and stale closures, console errors in the dev build.
Supabase setup and security
Row Level Security enabled and policies that actually make sense, tables readable or writable without auth, service role key exposure, table structure sanity.
Authentication and authorisation
Whether protected routes are protected server-side rather than only in the client, hardcoded credentials and test accounts, session and token refresh handling, role-based access enforcement.
Security
Exposed keys in client code, environment variable handling, injection and XSS risk, dependency currency, CORS configuration, critical and high CVEs.
AI code patterns and risk areas
Hallucinated dependencies that don't exist, unvalidated generated utilities, inconsistent patterns from stitched-together sessions, boilerplate error handling that doesn't handle real failures, leftover TODO placeholders, API integrations never checked against real documentation.
Plus six more across the wider system: Performance · Testing · DevOps, CI/CD and deployment · Observability and error handling · Accessibility and UX quality · Documentation and team practices · Business continuity and compliance.
Every check is rated Critical, High, Medium or Low. Worth doing before a funding round, before hiring your first engineer, before signing a development contract, or when you've inherited a platform you didn't build.
One product, one price
Technical Audit
Twelve domains, delivered in one to two weeks. Written report, severity-rated findings, prioritised roadmap and a walkthrough call. Payment is 50% on booking, 50% on delivery.
£2,500
Audit + implementation
Want the findings fixed as well as found? Implementation is quoted from the roadmap itself, so you only pay for what matters.
By scope
No tiers, no "from £X". If the answer to your problem is a half-day skim rather than an audit, the honest recommendation is a scoping call, not a discounted audit.
A four-part deliverable, every time
An executive summary
Two minutes to read, written for a founder or product lead rather than an engineer. Overall system health and the biggest themes.
A prioritised action list
Five to eight items, no more. The things that genuinely need attention in the next phase, in order.
Detailed findings
Every check across the domains in scope, each rated Critical, High, Medium or Low, with what I found and why it matters.
Appendices
The smaller observations - UI issues, styling inconsistencies, minor improvements - kept separate so they don't dilute the main list.
Three kinds of risk, because they need different responses
Operational risk
Things that could break the system or expose data.
Engineering quality risk
Maintainability problems that slow every future change.
Scalability risk
Bottlenecks and architectural limits you'll hit as you grow.
The product is usually fine. That's not the point.
That's the part founders get wrong when they brace for an audit. They expect to be told the thing they built is bad, and it almost never is.
Here's what tends to come back. Personally identifiable information written into logs, sitting there as a live compliance exposure nobody put there on purpose. Backups configured but never once restored, so nobody knows whether they work. No error tracking at all, which means failures are invisible until a customer describes one. AI-generated integrations never checked against the real API documentation. Dependencies that don't exist. Model calls firing on every request with no rate limit and no cost ceiling. A platform deployed by pressing publish in a no-code tool, with one contributor on the repository and no audit trail.
None of that makes a product bad. It makes it fragile in ways that are about to become expensive, and the founder is usually the last person to find out.
The output is a phased plan. Stabilisation first, to remove the immediate risk. Then controlled hardening, usually alongside whatever feature work can't wait. Then the scaling work. Roughly half of it is typically scoped so a developer can execute it with oversight rather than needing me to do it.
What people say about the audit
"This is beyond my expectations and provides more insight to my little site than I even knew was possible. I'm not a web developer but I feel like this audit just gave me a masterclass in it. These audits are clear, concise and packed full of useful and actionable steps to better my business. Thank you."
"Steven's audit was a great deal! I have done audits before - but Steven surfaced some items everyone else overlooked. Highly recommended!"
"Your audit served not only as an assessment but also as a valuable learning experience, deepening my understanding of my craft. Excellent and unique service!"
A fit if you have a live product and a decision coming up
Typically that means an early-stage founder or small team who has raised or is generating revenue. It's a fit if any of these are true:
- Most of your codebase was generated by AI and nobody has independently checked it
- An agency built your platform and you can't evaluate what you own
- You're about to hire your first engineer and want to know what you're handing them
- You're raising and expect technical due diligence
- You've inherited a platform and need to know what you've taken on
It isn't a fit if you're pre-idea, if there's no budget, or if you want the audit to be free on the promise of paid work later.
From first conversation to action plan
Scoping call20 minutes
Tell me what's built and what's worrying you, through the contact form. If an audit isn't the right thing, I'll say so.
Access
Repository, database, hosting and any documentation. Read-only is fine.
Review
Focused days across the twelve domains. I'll come back with clarifying questions rather than guessing at intent.
Report and walkthrough
The written document, plus a call to go through the findings and the priority order with you and your developer.
Whatever's next
Some people take the roadmap and execute it themselves. Some bring me back to do the first phase. Some move to an ongoing fractional CTO arrangement. All three are fine outcomes.
Why I know what to look for
I'm Steven Noble, a fractional CTO based in Berkshire. I've been designing and building for the web for nearly twenty years, seven of them agency-side, and the last two working directly with early-stage companies - taking ownership of architecture, product direction and delivery, usually in place of a larger engineering team rather than alongside one.
I've rebuilt a supplier and traceability platform and restructured the delivery behind it into a leaner architecture. I've audited AI-built platforms and turned the findings into phased plans teams could actually execute. I design as well as build, which means I read a codebase and a user journey as one system rather than two.
I also use AI heavily in my own delivery, with governance around it. That's precisely why I know what to look for.
The questions I get asked
- Will this just be a list of everything that's wrong?
- No. Anyone can generate that. The work is deciding which findings matter at your stage and in what order - a list of 200 issues is less useful than eight ranked ones.
- Do I need to give you production access?
- No. Read-only access to the repository and a view of the database schema and hosting configuration covers most of it.
- What if you find nothing serious?
- Then you have that in writing, which is worth having when an investor or a new hire asks. It's happened, and I'd rather tell you that than manufacture concern.
- Can you fix what you find?
- Yes, but the audit is priced and delivered independently of any follow-on work, and the roadmap is written so someone else could execute it.
- How is this different from an automated scan?
- A scanner tells you a dependency has a CVE. It can't tell you that your Row Level Security policies technically pass but allow one tenant to read another's data, or that a generated utility function looks correct and silently isn't.
- Do you sign an NDA?
- Yes, as standard.
Find out what's actually in your codebase
Tell me a little about your platform and what's worrying you. A scoping call takes twenty minutes and costs nothing - and if an audit isn't the right thing for where you are, I'll tell you that on the call.
Request a scoping call