Skip to content
Audit

Check whether it holds

An audit is not a list of things a linter dislikes. It is an ordered set of questions about the parts that lose you money or data when they fail, answered with evidence.

What is in this category

Audits that name the risk, not the smell

Each finding comes with what would actually happen, how likely it is, and what it would take to fix.

Architecture audit

Where the design fights the requirements, which coupling will bite during the next change, and what will not survive the growth you are planning.

Database audit

Schema, indexes, constraints, migrations and the queries that will fall over first. Includes what is not protected by a constraint but should be.

Deployment audit

How a release actually reaches production, what happens when it fails halfway, and whether rollback has ever been tested.

Dependency audit

What you depend on, what is unmaintained, what has known problems, and which upgrade is going to hurt.

Technical security review

Authentication, authorisation, input handling, secrets, exposed surfaces. Technical findings, not a compliance certificate.

Backup and recovery review

Whether the backups exist, whether they restore, and how long that takes. Most teams find out the answer at the worst possible moment.

How an audit runs

  1. Scope is fixed first

    What is being audited and what is explicitly out of scope, written down before anything is opened. An audit without a boundary never finishes.

  2. Evidence, then severity

    Each finding records what was observed and where, and only then how bad it is. Severity assigned before evidence is just an opinion with a colour.

  3. Findings are challenged

    A verification pass tries to disprove each finding. The ones that survive are the ones you act on.

  4. Ordered by consequence

    The report ends with what to do first, judged by what breaks and what it costs — not by how easy it is to fix.

When an audit is the right move

Not yet if

Nobody has written down what the system is

You are mid-migration and everything is in flux

You already know the answer and want it confirmed

The team has no capacity to act on findings

Yes if

Something failed and you do not know why

You are taking on more traffic, users or money

A customer or investor is asking hard questions

The people who built it are no longer around

Pick the category that matches your worry

Describe the situation in your own words and see the procedure — and its cost — before you spend anything.