Software code audit and technical due diligence

When a software code audit is worth it

An audit is cheap compared with the decisions it informs. These are the moments when it earns its keep:

• Before taking over an application from another supplier or a freelancer.
• Before investing or acquiring: technical due diligence on what you are actually buying.
• Before scaling a prototype, especially one built quickly with AI tools.
• After a security incident, or when a large customer sends a security questionnaire you cannot answer.
• When the cloud bill keeps growing and nobody can explain why.
• When nobody but its author has ever read the code, whether that author was a person or an AI tool.

What gets checked in a code audit

The audit covers the areas below. Security findings are mapped to the OWASP Top 10:2025, where broken access control is ranked first, so your team or any other supplier can follow them.

Vibe-coded app audit: what goes wrong in AI-generated code

AI tools now produce working apps in days. Working is not the same as safe. In a study published in July 2025, Veracode tested 80 coding tasks across more than 100 language models and found that the generated code introduced a security vulnerability in 45% of cases; on cross-site scripting, the models failed 86% of the time. Veracode sells security testing, so treat the figures as an order of magnitude, but the pattern matches what a security audit for vibe-coded apps typically checks:

• Permissions enforced only in the browser, so anyone who calls the API directly skips them.
• A database exposed to the browser without row-level security. Supabase's own documentation warns that a table in an exposed schema without RLS is readable and writable by any role with a grant on it.
• Secret keys in front-end code, in the repository history or in a public environment file.
• No limits on login attempts or AI endpoints, which invites abuse and surprise bills.
• Payment webhooks accepted without verification, so orders can be marked as paid by anyone.
• No tests, duplicated logic and outdated packages, which make every later change riskier.

Who owns AI-generated code? Handle with care

Ownership of AI-generated code is less settled than most buyers assume. Under section 9(3) of the Copyright, Designs and Patents Act 1988, the author of a computer-generated work with no human author is the person who made the arrangements necessary for its creation. However, in its report on copyright and AI of 18 March 2026, the UK government proposed removing that specific protection for wholly computer-generated works, while keeping copyright for works created with AI assistance.

In practice, three things matter: how much of the code reflects human direction and editing, what the AI tool's terms say about outputs, and whether your contract with whoever built the app assigns the rights to your company. The audit checks the practical side, such as whose name the repository and accounts are in and which open-source licences are involved. It is not legal advice: for the legal position, talk to an IP solicitor.

What you receive from the audit

A written report, with a plain-English summary for management and technical detail your developers can act on:

• Findings ranked by severity, each with evidence pointing to the exact file or setting.
• A fix-first plan: what to close this week, this month and this quarter.
• A clear recommendation on whether to repair, partly rebuild or start again, with the reasoning.
• An access and ownership checklist: accounts, credentials and assets to move into your company's name.