You inherited it. Nobody knows what is in it.
The software runs the business, and the person who built it has gone. I'll read it, tell you what it actually does, and give you the good, the bad and the ugly in plain English. £250 + VAT, five working days.
The software works. That is not the same as knowing it is safe.
Most of the applications we're asked to look at are doing their job. They've been running for years and the business depends on them. What has changed is that the person who built it has gone, there's no documentation (or it no longer matches the code), and every change feels like a risk, so changes that ought to happen don't.
Maybe it's on a framework or PHP version that stopped getting security updates a while ago. Maybe something breaks now and then and nobody can say why. Maybe someone's telling you it needs a full rebuild and you can't tell whether that's true. Either way, you'd like to know what you're sitting on before you spend another penny on it.
“It works” is a statement about today. A review is a statement about what happens next.
Not sure a review is the next step? Read keep it, fix it or replace it first.
The good, the bad and the ugly
Every System Review is written the same way. What's sound, what's costing you, and what shouldn't wait. In that order, because the good news changes the advice more often than you'd think.
One review last summer was three apps that ran a whole business. They turned out to be one system on one database, and the data and the business logic underneath were sound. Nothing needed reinventing.
That's not a footnote. It meant the answer was new foundations, not a new business, and it took a rebuild-everything conversation off the table before it started.
Not dangerous today, but it costs you every time somebody touches it. In that same review, all three apps were built on a low-code platform: about 6,700 small configuration files that only run inside the vendor's own system. There was no staging either, so every change went straight to live.
Nothing was on fire. The business was simply one vendor decision away from a much harder move than the one it could plan on its own terms.
The things that get fixed this week, whatever else happens. A few we've found in real systems, names left out:
- A full database backup sitting in a public web folder, downloadable by anyone who guessed the file name.
- An old admin screen open to SQL injection, years after it was written.
- Database passwords in plain PHP files on a shared server, readable by every other site on the box.
- The one we see most in apps built with AI tools: any logged-in user can read every other customer's records, because the check only happens in the browser.
A report you can read, and a straight answer
- A plain-English description of what your system actually does. For a lot of people this is the most useful page.
- The good, the bad and the ugly, worst first, each pointing at the part of the system it's about.
- A fixed price for each fix, so you choose what gets done and in what order.
- Where it's hosted, whether the backups actually restore, and who has access.
- What it costs to keep running and, if it isn't live yet, what it would take to get it there properly.
- A call to go through it, so nothing in it needs a dictionary.
Then a straight answer on what to do with it:
We don't push rewrites. A rebuild is the most expensive advice anyone can give you and very often the wrong one. If yours needs a list of fixes and not a replacement, that's what the report will say. There's no obligation to use us for any of it; the report is written so another developer could pick it up.
A review that turned into a plan, not a sales pitch
That three-app review didn't end with "rebuild it all, here's the bill". It ended with a phased plan the business could run at its own pace, keeping the old system working until each part was replaced:
We're building it now. We're not naming them, but if you're weighing up something similar, I'm happy to tell you how it's going on a call.
One system: the app or site, its server and its database. Got several, or a whole estate? We'll price it before anything starts, so there are no surprises.
The written report arrives within five working days of read-only access, then we go through it on a call. We invoice after a free first chat: no card details, no checkout.
The four things people ask
£250 + VAT, one fixed price for one system: the app or site, its server and its database. A bigger setup is priced up front before anything starts. Every fix in the report then comes with its own fixed price, and there is no obligation to use us for any of them.
The written report arrives within five working days of us getting read-only access, then we go through it with you on a call.
Usually not, and we have no incentive to: the review costs the same whatever we find. Plenty of older applications are doing their job well and need stabilising, not replacing. CodeIgniter 3 is end of life but still runs a great many production systems reliably. Where we do recommend starting again, it's normally because the data model can't support what the business now needs, and we'll show you the specific reasons. Not CodeIgniter or Laravel? Fine: we review plain PHP, older frameworks, .NET and classic ASP too, and COBOL and mainframe systems are a separate service. Built it with an AI tool instead? The AI code audit is the same review, written for you.
Read-only access to the code, a look at the database structure, and the hosting details if you have them. We don't deploy, change or run anything against your live data, and you can revoke the access the moment we're done. If you're not sure what you have or where it lives, say so. That's a normal answer here.
Book the Legacy Application Audit
Give us a call. Five working days later you will have a straight answer on what you are running.
- Security: access control, unpatched dependencies, end-of-life versions
- Database: structure, indexing, query performance
- Scalability: growth, concurrency, backups that have actually been tested
- Maintainability: could anyone else safely work on this?
Read-only access is all we need. Every fix in the report comes with its own fixed price.
Tell us what you have
Roughly what it is built with, roughly how old, and what is prompting you to look at it now. If you do not know what it is built with, say so. That is a normal answer here.
