Accounts & permissions
Can users read or change another customer’s records? I check server-side permission checks, account roles, downloads and shared links.
AI code audits / Security & privacy
Security and privacy checks before you launch.
I review AI-written code to find risks in how your app controls access and handles personal data. I check the code and agreed test environment, explain what I find and give your developers a prioritised repair plan.
UK-based and available internationally. Independent of AI coding platforms and scanning vendors.
01 / Security & privacy
Who can access the data, and where does it go?
A working sign-in screen tells you little about whether a customer can open someone else’s file or whether a log contains personal information. I trace those paths through the application and test the agreed boundaries.
Credentials & exposed data
I look for credentials in browser code and repositories, sensitive details in errors and logs, unsafe input handling and dependency risks.
Collection & sharing
What personal data does the app collect, and which services receive it? I trace storage, analytics and integrations against the intended use.
Retention & deletion
What happens when someone deletes a record or closes an account? I check the implementation and identify copies in files, logs, backups and connected services that need attention.
The findings distinguish issues I reproduced from concerns found in the code. Missing access and untested areas are recorded, so you know what the review established.
02 / What you receive
What you receive.
System & data map
A diagram showing where personal data enters, where it is stored and which services receive it.
Prioritised findings
Each issue includes the evidence, its likely consequence and the reason for its priority.
Action plan
Recommended fixes, issues that should block launch and checks to confirm each fix works.
Walkthrough
A conversation to explain the findings and answer questions from you or your developers.
For a worked example, read what a code review should tell you. The article includes a hypothetical finding and shows how it becomes a task a developer can act on.
Help with repairsYou can give the findings to your team or ask me to carry out repairs. We agree any development work separately.
03 / Launch readiness
Launch readiness review.
A launch readiness review adds operational checks to the agreed security and privacy scope. I look at the important journeys, how releases happen and whether the service can recover when something fails.
Architecture & data
System boundaries, data ownership, coupling, duplication, state, concurrency and scaling assumptions.
Data integrity
Duplicate requests, concurrent updates, transactions and whether a failed operation leaves records in the wrong state.
Reliability & operations
Failure handling, retries, timeouts, deployment, rollback, backups, logs, metrics and alerts.
Maintainability
Code organisation, tests, dependencies, consistency, documentation and the cost of future change.
Sample report / Fictional application
See what a finding looks like.
A finding should explain the problem, who it affects and how to check the fix. This example comes from the Siege21 sample report.
All details are fictional. No real application was reviewed and no tests were run for this sample.
Download the sample reportPDF · 6 pages · 41 KB · No email required
E-001 / Illustrative findingHigh · Before release
Documents can be read across workspaces.
The example app checks that a user is signed in, but misses the check that they belong to the document’s workspace.
- Consequence
- A signed-in user who obtains another workspace’s document ID can read its contents.
- Example evidence
- An account from Workspace A requests a Workspace B document. The fictional result is that the document is returned.
Recommended fix and verification
Fix
Check workspace membership and document permissions before returning metadata or file contents. Apply the same checks to previews and downloads.
Verify
Requests from another workspace return no document content. Authorised reads, previews and downloads still work.
Adapted from sample finding E-001, page 4. Severity is illustrative; confidence was not assessed.
04 / Scope & access
Agreeing the review.
We start with what the app does, who uses it and the decision you need to make.
I’ll confirm the scope, fees and timing before work starts. We agree which code version and environments I’ll review, the access I need and any exclusions. The proposal also sets out whether checking subsequent fixes is included.
05 / Questions
Questions about code reviews.
What do you mean by an AI code review?
It means I review software built with AI assistance. I also use “audit” to describe this service. I carry out the review myself, using tools where they help. If your product includes an AI model, any assessment of that model’s behaviour needs its own agreed scope.
What does the privacy review cover?
I trace how the application collects, stores, shares and deletes personal data. This includes logs, analytics, external services and backups within the agreed scope. I look for unnecessary collection, unintended exposure and gaps between the intended behaviour and the implementation. This is a technical review, not legal advice or a compliance certification.
Which review should I choose?
The security and privacy review focuses on access and personal data handling. The launch readiness review adds agreed deployment, integration, failure and recovery checks. Compare the two options.
What does a review cost, and how long does it take?
I quote after scoping the app. The number of workflows, repositories, integrations and environments affects the work involved. You receive the fee and expected delivery date before committing.
Are repairs and retesting included?
Repairs are quoted separately. The review proposal states whether a recheck is included, which fixes it covers and any time limit. A recheck records what has been resolved and what could not be verified.
Will you identify every security vulnerability?
No. I check the security risks within the agreed scope and record what I could not examine. This service does not include a formal penetration test or certification.
Can you review a partially completed application?
Yes. Reviewing before launch often creates more options and avoids building further on unstable foundations. The scope will distinguish incomplete work from genuine defects.
Does it matter what the app was built with?
I work across languages and platforms. The review follows how your application handles access, data and failures. We’ll look at the code and setup when agreeing the scope.
Do you work outside the UK?
Yes. I’m based in the UK and work remotely with international clients. We’ll agree access and working hours before starting.
Independent engineering review
Check your app before customers trust it with their data.
Tell me what the app does, what personal data it handles and when you plan to launch. I’ll help define the review scope.
Discuss a review