What is unsupported, what is end of life, what carries known vulnerabilities, and the effort to bring it current. Usually the most expensive finding.
KeevaathTech/Services/Software audit
LENS · KPA-SA
Software audit
An examination of a codebase you already own, to decide what to fix and in what order. Usually bought because changes have become slow and nobody can say why.
What this is
An examination of a codebase you already own, to decide what to fix and in what order. It returns the health of the code, the risk carried by its dependencies, how much of it is tested, and how expensive it is to change.
The usual reason for buying one is that changes have become slow and nobody can say why.
What gets examined
Dependency and version risk
Test coverage
Not the percentage, which is easy to game, but whether the tests would catch the failures that actually happen.
Maintainability
Where the code resists change. Duplication, coupling, and the parts nobody on the team is willing to touch.
Deployed against recorded
What is actually serving, read directly, compared against the repository and the documentation. They differ more often than anyone expects.
Release process
How code reaches production, whether it can be rolled back, and whether shipping is routine or an event.
Naming and structure
Whether a developer debugging by reading names is reading a fiction. This sounds cosmetic and it consumes sessions.
Security configuration
Secret handling, access control, exposed endpoints, and dependency vulnerabilities with a path to exploitation.
Key person risk
How much of the system only one person understands, measured from the commit history and from how the code reads.
What you receive
Findings grouped by root cause
Not by file. One component corrected properly usually closes twenty items, and a list ordered by file makes that invisible.
A sequenced remediation plan
What to do this month, this quarter, and what to leave alone. That last category is the one most audits omit, and it is the one that makes a plan finishable.
An upgrade path, costed
Where dependencies are behind, the route forward with effort attached. React sixteen to nineteen, Node to current long term support, Express to Next.js route handlers, WordPress to headless.
A walkthrough
An hour with whoever will do the work, because reports get filed and conversations get acted on.
Stacks we audit
Node, Express, React, Next.js, MongoDB, TypeScript, Vue, Laravel, Firebase and React Native. Also WordPress and PHP estates, including ones with no documentation and no original developer available. That last case is the most common and the most useful.
Questions we are asked
How long does it take?
Five to twelve days of effort depending on the size of the codebase and how many services it spans.
Do you need production access?
Read access to the repository is essential. Access to the running system is strongly preferred, because what is deployed and what is recorded diverge, and that gap is frequently the finding that matters most.
Will you tell us to rewrite it?
Only if rewriting is genuinely cheaper, which is rare. Most codebases that feel unsalvageable need a dependency upgrade, a test harness and three components refactored.
Is this the same as due diligence?
No. A software audit examines a codebase you own, to decide what to fix. Due diligence examines one you are considering acquiring, to decide what to pay, and carries reliance language an audit does not.
Can you audit something you did not build?
That is the normal case, and it is what this exists for.
Send the questionnaire and we will price it.
About fifteen minutes. Tell us what is working well today that must survive the change, because that question shapes the plan more than any list of problems.