Security and code audits

What gets checked

• Security: who can read, change or delete what, with and without logging in.
• Licenses and provenance of code, assets and dependencies, so what you sell is yours to sell.
• Data protection in code where it applies: GDPR and the Swiss nDSG, the European Accessibility Act, PCI DSS 4.0 payment-page scripts. I check the code; your lawyer or assessor signs it off.

How it runs

• Your repository is checked out on an isolated machine used only for your project.
• Tooling maps what the code exposes before anyone reads it: routes, endpoints, forms, and who is allowed to call them.
• With AI allowed under the build policy, one model analyzes each candidate finding and a separate one tries to disprove it. Without AI, I do all of it by reading.
• Every finding checked by hand before it goes into the report, with its severity scored by CVSS 4.0, so the ranking can be checked.
• What the code alone can't prove comes to you as an open question, not as a finding.

What you get

• A written report with findings ranked by severity, each worded so the business owner can act on it.
• For each finding: the affected files and lines, how someone gets there, what it costs the business, and what to do about it.
• Fixed quotes for the fixes you want me to make. Nothing is deployed without your sign-off.

What moves the price

• The size of the code. The entry price covers a small codebase, about 10,000 lines.
• How much it exposes: endpoints, user roles and the integrations it talks to.
• Payments and sensitive data, such as health or personal records.
• Compliance deliverables, and deadlines shorter than two weeks.

Add-ons, quoted on top

• Penetration testing: I attack a copy of your site, set up with your code and scrambled data, the way an outsider would. Done by hand, never with AI.
• A retest once your fixes are in, to confirm they hold.

Questions

How long does an audit take?

It depends on the size of the code. A codebase like the one in the case study, 1,200+ files, takes about 20 days of work.

What do you need from us?

Usually access to the codebase, for example a private GitHub repository. If the database needs analyzing, access to that as well. Nothing runs against your live system.

Which code can you audit?

Any code. PHP and WordPress are my home turf, but the method works on any stack; the review in the case study was a TypeScript and Next.js platform.

Is this a penetration test?

No. The audit is an analysis of the code: how it talks to the database, which input goes unchecked, who may do what. Penetration testing is a separate service on top, done by hand and never with AI, on a copy of your site with scrambled data.

Does it make us compliant?

I'm not a lawyer, so I can't sign off on compliance. I can find what the code gets wrong and write it the way it has to be.

Do you check again after we fix things?

Yes, if you want it. Retesting is quoted on top of the audit.

Will you sign an NDA?

Yes. Tukutoi LLC signs NDAs and other legal agreements.

From 4,500 CHF (about 5,450 USD, 4,900 EUR), fixed scope. You get a fixed quote before any work starts. Write to me.