How do I do a code audit to verify what I received from a development agency?

Why You Need an Independent Code Audit

Taking delivery of a codebase without verifying it is like buying a house without an inspection. In the US, most commercial contracts tie final payment to acceptance — an audit gives you objective grounds to accept, reject, or negotiate fixes before that milestone closes.

The Four Areas to Cover

1. Architecture and Code Quality

• Does the structure match what was scoped (monolith vs. microservices, chosen frameworks)?
• Is the code readable and consistently formatted, or is it held together with workarounds?
• Are there hard-coded credentials, secrets, or environment variables baked into the repo?
• Run static analysis tools: SonarQube, ESLint, or language-specific linters depending on the stack.

2. Security Vulnerabilities

• Scan dependencies for known CVEs using tools like Snyk, OWASP Dependency-Check, or npm audit.
• Check for OWASP Top 10 issues: SQL injection, XSS, broken authentication, insecure direct object references.
• Verify that secrets management (API keys, DB passwords) follows best practices — nothing committed to version control.

3. Test Coverage

• Request the test suite and run it yourself. What percentage of critical paths have unit or integration tests?
• Low coverage (under ~60–70% on critical modules) means bugs are hidden, not absent.
• Check whether CI/CD pipelines exist and whether tests actually run on every commit.

4. Documentation and IP Completeness

• Is there a README, architecture diagram, and deployment guide — or do you need the agency to explain every component?
• Confirm you received full source code, not just a build artifact or hosted environment access.
• In the US, make sure your contract assigns IP to you explicitly; a code audit is also a good moment to verify there's no GPL-licensed code embedded in a commercial project without a license exemption.

How to Run the Audit

1. Get a full repo export — all branches, commit history, environment configs (sanitized).
2. Run automated tools first — they surface the obvious issues cheaply and fast.
3. Bring in a senior independent engineer or firm — automated tools miss logic errors, poor architecture, and hidden backdoors.
4. Document findings in a written report — categorized by severity (critical, high, medium, low). This report becomes your negotiating document if remediation is needed.

Honest Tradeoffs

CodeNicely offers independent code audits and can assess codebases built by any agency — not just their own work. That said, any experienced independent engineering firm or a US-based freelance CTO can do this competently; the key is that the auditor has no financial stake in the original build.