01 · CheckPerlustra, the codebase health audit
A five-day code audit before anyone changes your app
Before anyone touches your application, you should know what is actually there. The Perlustra audit is a fixed-price, five-business-day review of an existing web application — React/Next.js, Node.js/TypeScript or .NET — and the first step in any software project rescue or takeover. It ends with a written report and a prioritised plan with a sprint price. You can act on the plan with us or with anyone else.
01Who it is for
Who the audit is for
- You inherited an application and nobody can tell you how healthy it is.
- Your developer or agency has left, gone quiet, or been let go.
- You are about to raise money, sell the company or sign a big customer, and someone will ask about the code.
- You want to add features — or AI — and suspect the foundation will not take it.
- You built a first version with an AI coding tool and need it made safe before real users touch it.
02What we inspect
What we inspect
The emphasis follows your situation: ownership and access first if the previous team is gone, security and outdated parts first if the application is simply old.
- Architecture and dependenciesIncluding every end-of-life framework, runtime and package.
- Build, deploy and environmentsCan it be built from a clean machine? Who holds the keys?
- Tests and CIWhat exists, what it covers, what breaks.
- Security hygieneAuthentication, secrets handling, known vulnerabilities, OWASP basics.
- Speed and hosting costPerformance hot spots, page speed (Core Web Vitals) and hosting cost signals.
- AccessibilityA WCAG 2.2 check of the main journeys: keyboard, contrast, labels and structure.
- Search healthIndexing, redirects, structured data and how your pages render for search engines.
- Data layerSchema, migrations and backups.
- DocumentationWhat is written down, and how much depends on one person.
- OwnershipDomains, hosting accounts, third-party services and licences.
03Day five
What you receive on day five
- A written report (the structure is public: see the sample on the Work page): an executive summary with the three findings that matter most, a ten-point scorecard, detailed findings with evidence and severity, and a risk register.
- A prioritised plan in three horizons — Stabilise (what must happen now), Upgrade (what should happen this quarter), Evolve (what becomes possible after) — each with a fixed sprint price and written exclusions.
- A 45-minute walkthrough call.
04How it runs
How the five days run
- Day 0
Access and kickoff
Read-only access to repositories, CI and environments, and a 30-minute kickoff.
- Days 1–4
Review
Review, static analysis, a build from a clean machine, test runs and targeted deep dives.
- Day 5
Report and walkthrough
The report is delivered and the walkthrough is booked. Nothing is changed in your systems during the audit.
05Takeovers
If your developer has disappeared
A takeover starts with recovery, not code: who owns the domain, the hosting account, the source repository, the app-store and third-party accounts, and the secrets. The audit begins with an ownership and access inventory and tells you what to recover first, what can be rebuilt from deployed artefacts if the source is missing, and what should be rotated immediately.
If you have no repository access at all, book the triage call first — in some cases the audit must be preceded by a short recovery task.
06AI-built apps
Apps built with AI coding tools
Applications generated with AI coding tools (often called vibe-coded apps) ship fast and often ship without authentication boundaries, input validation, secret handling, tests or a deploy process. The audit treats them like any inherited codebase, with extra attention to data exposure, dependency sprawl and hidden costs, such as API keys billed to the founder's card. The outcome is the same: a report and a priced plan to make it safe for real users.
07Questions
Frequently asked questions
Not answered here? Ask on the triage call.
What does a technical audit include when rescuing a failing software project?
Everything listed under What we inspect, with the emphasis set by your situation — ownership and access first if the previous team is gone; end-of-life and security first if the app is simply old.
How can documentation be recovered if the previous developer is unresponsive?
From the artefacts: the code itself, deployment configuration, database schema, logs, and the behaviour of the running system. The audit produces a system overview that becomes your first real documentation.
What if the previous agency keeps ownership of the hosting or domain account?
The report lists every account that is not in your name and a recovery order. We do not litigate; we tell you what to ask for and how to migrate if an account cannot be recovered.
How is intellectual property handled during a takeover?
Read-only access under a mutual NDA for the audit; all later work happens in repositories and accounts you own; deliverables are yours on payment.
When should an application be rebuilt instead of fixed?
Rarely. A rebuild usually costs more than a staged modernisation, delivers nothing until it is finished, and loses working business logic. The report states the case either way with evidence; if a rebuild really is cheaper, it says so.
What does a takeover, audit and stabilisation typically cost?
Each step has a fixed price agreed in writing before it starts. The audit fee is confirmed on the triage call; the report prices the sprint that follows, with written scope and exclusions. Nothing is billed by the hour, and 50% of the audit fee is credited if you go ahead within 30 days.