You inherited it. Nobody knows what is in it.

The software works. That is not the same as knowing it is safe.

Most of the applications we are asked to look at are doing their job. They have been running for years. The business depends on them. What has changed is that the person who built it has gone, nobody left can explain how it works, and every change feels like a risk.

• The original developer left, and took the only understanding of the system with them
• There is no documentation, or what exists no longer matches the code
• Nobody is confident enough to make changes, so needed changes do not get made
• It is on a framework or PHP version that stopped getting security updates a while ago
• Something breaks occasionally and nobody can say why
• You are being told it needs a full rebuild, and you cannot tell whether that is true
• You are about to invest in it, and want to know what you are investing in first

A written report, and a straight verdict

Within five working days of getting access: an executive summary you can hand to someone non-technical, severity-rated findings pointing at specific parts of the code, a prioritised list of what to fix and roughly what each item takes, and — the part most clients say they value most — a plain-English description of what your software actually does.

Then one of three verdicts:

We do not push rewrites. A rebuild is the most expensive advice anyone can give you and it is very often the wrong one. CodeIgniter 3 is end of life, but it still runs a great many production systems reliably. Plenty of the applications we audit need a specific list of fixes, not a replacement. If that is your situation, that is what the report will say.

Questions

The original developer has gone and there is no documentation. Is that a problem?

No — that is the normal case, and it is most of why people call us. We read the code rather than relying on documentation. Part of what you get back is a plain-English description of what your software actually does, which for a lot of clients turns out to be the most useful thing in the report.

Will you tell us to rebuild it?

Usually not, and we have no incentive to — the audit is a fixed price whatever we find. Where we do recommend it, it is normally because the data model cannot support what the business now needs, and we will show you the specific reasons.

Do you need to take the system down?

No. The audit is read-only. We do not deploy, modify or run anything against your production data. We need the code and, ideally, a look at the database structure.

What if it is not CodeIgniter or Laravel?

Fine. Most of our legacy work is PHP — CodeIgniter and Laravel especially — but we audit plain PHP and older frameworks too, and there is a separate service for COBOL and mainframe modernisation. Tell us what you have and we will confirm before you commit to anything.

We built it with an AI tool rather than inheriting it. Is this the right audit?

Close, but there is a version written for exactly that: the AI Code Audit. Same price, same turnaround, aimed at applications generated with Lovable, Replit, Bolt and similar. If you are not sure which fits, ask us and we will tell you.

What happens after the report?

You decide. There is no obligation to use us for any of the work, and the report is written so another developer could act on it. If you do ask us to do the work, the £495 + VAT comes off the cost in full.