Audits and code review
A senior review of your code, modules and setup that finds the risks before your customers do. Every finding comes ranked by severity, with evidence and an estimate in hours.
Who this is for
- Merchants taking over a store from another agency or a departing team
- Engineering leads, including teams on Adobe Commerce, who want an outside senior opinion before an upgrade or a big release
- Agencies that need an independent review to settle a quality question with a client
What you get
A map of what you run
Every custom and third-party module, integration and cron job, with who owns it and what depends on it.
Risks ranked by impact
Stability, performance, code quality and upgrade blockers, each with severity, evidence and an estimate in hours.
Concrete fixes you can assign
File and line references, with the change I would make and why, so your team or agency can act on it.
A summary for decision makers
One page that says what is urgent, what can wait and what it costs, readable in five minutes.
How it works
Days 1 to 2
Access
Weeks 1 to 2
Review
Final week
Report
In detail
Every store that has run for a few years carries risks nobody has written down. A payment module sits two major versions behind, or custom code rewrites prices on every request. A cron job fails silently, or an old extension blocks the next upgrade. They stay invisible until a sale weekend or a security patch exposes them.
An audit reads the code that runs in production. I look at custom and third-party modules, configuration, database and indexing, integrations, caching and hosting. Then I separate what is risky from what is merely unusual.
You get a ranked list of findings with evidence and estimates, so you can fix the worst items first and plan the rest. A one-page summary tells decision makers what is urgent and what it costs. If you want, I can also review pull requests afterwards to keep new code from adding new risk.
I have reviewed Magento and Adobe Commerce code since 2009, first in Magento’s original Expert Consulting Group and later at Guidance for 8-figure-GMV merchants.
We start with read-only access to the repository and a staging copy, plus a short call about the problems you already know.
Questions
How long does an audit take?
One to three weeks, at a fixed scope. I review code, configuration, database, integrations and hosting against the platform's coding standards. In the final week I walk your team through the findings on a call.
What do you need from us?
Read-only access to the repository, a staging copy and your monitoring, plus a short call about the problems you already know. Access is set up in the first two days.
Can our team or agency fix what you find?
Yes, that is what the findings are written for. Each one has file and line references, the change I would make and why. A one-page summary tells decision makers what is urgent and what it costs.
Do you review code after the audit?
Yes, if you want. After the audit I can review the pull requests of your team or agency, so new code does not add new risk.
Can an audit settle a quality dispute with our agency?
Yes. An independent review gives both sides the same findings to discuss, each with its severity and evidence. Agencies use it too, when they need to settle a quality question with a client.
Related case study
−50 %Typical page load
Halving page-load times for an 8-figure e-learning store
Read the case study