Full Monty audit
A code audit that finds what your tests don't.
Security, performance, and UI/UX — three parallel scans of your actual source, on any stack, delivered as a prioritized PDF report.
It isn't a scanner you buy off the shelf, and it isn't someone clicking around your live app for an hour. I read the code, run the tests, and cross-check three independent passes before writing anything up.
What it is
An end-to-end audit that reads your source
The Full Monty is a structured audit run against your codebase on disk: no production access, no live credentials, no real users touched. Static analysis and source review, then a report your team, board, or auditor can act on.
Report only
The full audit, delivered as a written report. Your team ships the fixes on its own schedule.
Report + Fix
The audit plus prioritized patches applied by me, with the fixes re-checked against the original findings.
Fix only
Already have a report? I apply the patches from it.
What gets scanned
49 checking classes, every engagement
Security, performance, and UI/UX are all non-optional. There is no “we'll do security this round and performance next round” upsell.
Security · 16 classes
SQL injection, XSS, CSRF, IDOR, auth bypass and privilege escalation, hardcoded secrets, session and cookie hardening, file upload and path traversal, timing attacks, race conditions, information disclosure, insecure deserialization, open redirects, missing rate limits, CORS and origin checks, header injection.
Performance · 16 classes
N+1 queries, missing or unindexed query paths, unbounded result sets, sync external calls in hot paths, caching, asset bloat, render-blocking resources, DOM size, memory hot paths, resource leaks, cron inefficiency, boot-time work, frontend runtime cost, payload size, connection pooling, missed parallelism.
UI/UX · 17 classes
Accessibility, form UX, loading and empty states, error handling, information architecture, visual consistency, responsive design, internationalization, state and feedback, discoverability, dialog abuse, custom widgets, dead UI, contrast, copy, motion, and print or export.
The deliverable
A PDF your team can work from
Every engagement ships a project-branded report. No vague “your code could be better” hand-waving.
- An executive summary with total findings and severity counts.
- Three findings sections — security, performance, and UI/UX — each with its own severity table.
- One finding per row: ID, severity, class, file and line, code excerpt, description, and recommended fix.
- A methodology section, so another engineer can verify or repeat the audit.
- Stack-specific tooling recommendations, including what the automated passes may have missed.
- Excluded folders and deletion policy, so the report doubles as a deploy checklist.
Finding IDs stay stable across tracks: H-NN for security,
P-NN for performance, U-NN for UI/UX, with
M-NN and L-NN for severity. “Fix H-04 by Friday” is
unambiguous.
Process
How an engagement works
Scoped before work starts, with a fixed quote and a clear list of what you get.
Day 0 — Intake
A free 30-minute call: stack, where the code lives, known pain points, and deadlines. I tell you whether I'm the right fit and quote the work.
Day 1 — Kickoff
You share the repo or a read-only mirror. I record the project profile — paths, deploy target, infrastructure quirks, conventions — and confirm scope.
Days 2–4 — The cycle
Tests, three scans in parallel, cross-referenced findings, and the written report. For Report + Fix, high-priority patches are applied and re-verified.
Day 5 — Delivery and re-audit
PDF, raw findings JSON, tooling reports, and any patch set, plus a 60-minute walkthrough call. An optional focused re-run after fixes is available at a discounted rate; most clients do it at least once.
Where AI fits
AI is part of the method, not the whole audit
Two AI passes run alongside conventional static analysis, and every finding is cross-referenced before it reaches the report.
One model reviews each file individually through a six-threaded worker. A second pass runs regex and heuristic sweeps for patterns the model might miss. Findings from both feed the same PDF, and a methodology section explains exactly what was used.
The audit also runs the tools that are idiomatic for your stack — PHPStan, ESLint, Semgrep, Bandit, gosec, govulncheck, cargo audit, npm audit, Trivy, gitleaks, detect-secrets — and feeds their output into the review. The AI is a tool, not a replacement for reading the code.
If the code can't leave your infrastructure, the full cycle can run on a VM you provide, with no external network calls and the tooling and models running locally. That setup carries an extra fee; ask about it on the intake call.
When to hire me
Pick the moment that fits
The audit is most useful when a decision depends on knowing what is actually in the codebase.
- You're shipping a major release. Know what else is in there before it goes out the door.
- You've inherited a codebase. Promotion, acquisition, new job, contractor handoff — get a prioritized punch list fast.
- You're about to take on real risk. Outside users, real money, sensitive data, SOC 2 preparation, HIPAA scope, payment flows.
- Your tests pass but the app feels wrong. Slow pages and odd UX are exactly what the performance and UI/UX scans are for.
- You need a written artifact. A board, investor, enterprise customer, or auditor will read a polished PDF with severity counts.
Recent engagements include LunasOS, JobPulse, Request Portal, Fumos, and OpenBuilder. Pricing is per engagement, scoped to codebase size, mode, stack, and urgency. Standard turnaround is five business days; a two-day rush is available at a premium.
Want to know what's in your codebase before someone else finds it? Book a free 30-minute intake call through the contact page, or email contact@georgethegeek.com.