Contents
A security audit reviews an application’s code, configuration, access rights and data to find flaws and rank them by priority, using frameworks such as the OWASP Top 10. I offer an express audit at $660 (€589)excl. VAT over a few days and a full audit at $2,300 (€1,990)excl. VAT over 5 to 7 days.
Your application handles customers, orders, employee data. It was built quickly, or by a provider who is no longer around, or with an AI tool. A major customer is asking for security guarantees. In all these cases, an audit tells you where you stand before an incident does. Here is what it checks, how it works, what it costs, and what it does not replace.
Two options
The security audit is part of my technical audit, which also covers architecture, performance and the database. Amounts exclude VAT:
| Express audit | Full audit | |
|---|---|---|
| Price | $660 (€589)excl. VAT | $2,300 (€1,990)excl. VAT |
| Duration | A few days | 5 to 7 days |
| Scope | Technical audit and performance analysis, with the priority security points | Six areas: architecture and code, performance, security, SEO and accessibility, database, mobile and PWA |
| Deliverable | Report and personalized optimization plan | Detailed report, prioritized and costed action plan |
| After the audit | 2-hour debrief, 30 days of support | |
| Best for | Finding out quickly where you stand | Deciding on a takeover, a rebuild or a remediation plan |
What gets checked
I rely on the OWASP Top 10, the reference list of web application security risks, in its 2025 edition (checked October 27, 2026). In practice, for a business app, the security audit covers:
- Access control (A01): does each role see only what it should? Are permissions enforced on the server and in the database? It is OWASP’s top item and the one I test most thoroughly, account by account (see managing role-based access).
- Configuration (A02): debug mode left on, security headers, default accounts, file storage open to the public.
- Dependencies (A03): outdated libraries or ones with known vulnerabilities, where installed packages come from.
- Encryption and secrets (A04): API keys in the code or in the browser, properly stored passwords, encrypted connections.
- Injection (A05): queries built from user input without protection.
- Authentication (A07): password strength, limits on login attempts, two-factor authentication, password reset.
- Logging (A09): do sensitive actions leave a usable trail in case of an incident?
- Error handling (A10): do error messages reveal technical details?
On top of that come backups and basic GDPR compliance: data collected, retention periods, processors. The detailed list of common flaws is in the most common security flaws in SMB applications.
How the full audit works
| Step | Duration | Content |
|---|---|---|
| Initial analysis | 1 to 2 days | Gathering technical information and access |
| In-depth audit | 3 to 5 days | Automated tests, manual code review, tests with each role |
| Recommendations | 1 to 2 days | Prioritized, costed action plan, with a roadmap |
| Debrief | 2 hours | Presenting the findings to your team |
The audit runs in read-only mode or on a copy. Findings are ranked by severity: fix now, schedule, monitor.
When to get an audit
- Before going live, especially if the app stores personal or financial data.
- Before taking over an app built by another provider, with no-code or with an AI tool (see AI project takeover).
- When a customer or principal asks for security guarantees.
- After an incident, to understand what happened and prevent a repeat.
- Periodically, for an app that changes a lot.
What an audit does not replace
I will be straightforward: my audit is a code and configuration audit carried out by a developer. It does not replace:
- a qualified penetration test, when a contract or regulation requires one. In France, ANSSI qualifies information system security audit providers (PASSI, in French), whose scope includes penetration testing and code and configuration audits;
- an audit of your entire IT system: workstations, network, email, staff awareness;
- legal advice on your GDPR compliance.
If your need falls into one of these cases, I will tell you on the discovery call, and the application audit can then prepare the ground for the qualified provider.
Where to start
- A 30-minute call to describe the application and your goal: I will tell you which option fits.
- Sending the access: code, hosting, test accounts.
- The audit, then the report.
- The fixes, with the team of your choice. If the app needs to be taken over or put into production, the page on moving an internal prototype to production safely explains the steps.
Both options are summarized in the table at the top of this page. If the audit concludes that a rebuild makes more sense, the estimator gives you a first range.
Frequently asked questions
What is the difference between an audit and a penetration test?
The audit I carry out looks at the application from the inside: code, configuration, permissions, dependencies, database. A penetration test simulates an outside attack, often without access to the code. The two complement each other. For a penetration test required by a customer or a regulation, use a qualified provider; in France, ANSSI qualifies security audit providers (PASSI).
What access do you need?
The source code, read access to the hosting and database configuration, and one test account per user role. The audit runs on a copy or in read-only mode: nothing is changed in your production environment.
What happens after the audit?
You receive a report listing the findings ranked by severity, plus a costed action plan for the full audit. You can fix the issues with your team, your current provider or with me. The full audit includes a 2-hour debrief and 30 days of support to answer your questions.
Does an audit guarantee there are no flaws left?
No. No audit can guarantee that. It sharply reduces the risk by addressing the most likely and most serious flaws, at a given point in time. Security then has to be maintained: updates, permission reviews, checks on new features.
My app was built with an AI tool: is the audit a good fit?
Yes, it is one of the cases where it helps most. Quickly generated apps often work well in a demo but have gaps in access control and key management. The audit is the first step before any takeover.