Cookies on AIGROW

We use necessary cookies to run the site. With your permission, we also use cookies for analytics, session recordings and marketing attribution.

Cookie Policy

Written code audit: one repository read with read-only access, with security findings by file and line, technical debt in days and the ten changes to make first

$490Fixed price, paid onceReport within 10 working days of access

Order for $490How it works

Read-only access only: no live systems, no production credentials. If we do not deliver what the page lists, you get a full refund.

AIGROW audits one repository of up to about 100,000 lines of application code for $490, paid once. With read-only access, within 10 working days, we deliver a written report: security findings ranked by severity with file and line, dependency and licence risks, code quality and test coverage, technical debt in days, and the ten changes to make first.

What the audit covers, and what it does not

Before a round or a sale, or after taking over an application, the question is what is in the code and what it will cost to fix. We read the repository and answer in writing, with every finding tied to a file and a line.

What it does
  • Reads one repository, up to about 100,000 lines of application code, from a read-only invite or a zip export
  • Finds security issues in the code and ranks them Critical, High, Medium or Low, each with the file and line, its OWASP Top 10:2025 category and the fix
  • Searches the code, and its git history when we have it, for committed secrets such as API keys and passwords
  • Lists the third-party dependencies with their known vulnerabilities, how far behind each one is and whether it is still maintained
  • Lists the licence of each dependency and flags the ones your lawyer should read, such as GPL or AGPL, or packages with no licence at all
  • Assesses code quality: the structure, duplication, the most complex files and how errors are handled
  • Runs your test suite in an isolated copy with no access to your systems and reports the coverage, or says why it could not run
  • Lists the technical debt, each item with an effort estimate in engineer days
  • Ends with the ten changes to make first, in order
What it does not do
  • It does not test live systems: no penetration test, no scans of your servers or domains, no requests to your running application
  • It does not use production credentials or passwords, and we decline them if sent. Read-only access to the code is all we use
  • It does not fix the code. The report says what to change and roughly how long it takes; your team or your contractor makes the changes
  • It is not legal advice and we are not a law firm. Licence findings flag what a lawyer should review
  • It does not certify the code as secure or promise an outcome for your round or your deal. It reports what we found at the commit we read
  • It covers one repository up to about 100,000 lines of application code. Larger codebases get a written quote before any work starts

From payment to the report

Each step and when it happens. The 10 working days start when we can read the repository.

Pay at checkoutPay once by card at the Stripe checkout. Stripe sends the receipt.2 minutes
Give us read-only accessWe email you straight after payment. Invite hello@aigrow.gg with read-only rights or send a zip export, and answer a few written questions about the code.About 20 minutes
We size the codebaseWe count the lines of application code. If there are up to about 100,000, the work starts. If there are more, we send a written quote or refund you in full, your choice.Within 1 working dayOf access
We read the codeScans for vulnerable dependencies, licences and committed secrets, then a read of the code itself, its tests and its history. Every finding is checked against the code before it goes in.Working days 2 to 9
The reportYou get the summary, the security findings with file and line, dependencies and licences, quality and coverage, technical debt in days and the ten changes to make first.Within 10 working daysOf access
Your copy is deletedWe delete our copy of the repository 30 days after delivery, or sooner if you ask, and confirm it in writing. Remove our invite on your side.30 days after delivery

One repository, one price

Paid once at checkout, which asks for your email and card. Right after payment we email you a few written questions and how to give us read-only access. The report follows within 10 working days of access. For a repository above about 100,000 lines of application code, write to hello@aigrow.gg for a written quote before you buy.

What we need from you

Reply to our email with read-only access (the Read role on a GitHub organization repository, Reporter on GitLab, Read on Bitbucket, or a zip export), the branch to audit, what the application does, how to run its tests and why you want the audit. Never send production credentials or passwords.

What you receive

  • A one-page summary in plain words for founders, investors and buyers
  • Security findings ranked by severity, each with file and line, the evidence and the fix
  • Secrets found in the code or its history, listed so you can rotate them
  • Dependency risks: known vulnerabilities, outdated and unmaintained packages
  • A licence inventory, with the licences to review flagged
  • Code quality and test coverage, measured where your tests run
  • Technical debt, each item with an effort estimate in days
  • The ten changes to make first, in order

Written code audit

$490

Paid once at checkout. No subscription, nothing renews. Charged in US dollars at the price shown.

If we do not deliver what this page lists, or you change your mind before work starts, you get a full refund.

Why buy it from AIGROW

What you can check before you pay, and after the work.

A fixed price
$490, paid once. No subscription, nothing renews. Everything included is listed on this page before you pay.
Proof you can check
Every security finding names the file and line it sits on and quotes the code, so your developers can check it and confirm the fix. A finding we cannot point to in the code stays out of the report.
A public method
The AI Visibility Index publishes how it asks ChatGPT, Claude, Gemini and Grok about local businesses and how it counts the ones they name. Read the Index method

Before you buy

Who it is for, the access we need, what we never touch, larger codebases, severity, estimates, AI tools and your code.

Founders preparing a funding round or a sale, who want an outside read of their code before investors or a buyer review it. Buyers in an acquisition who want an independent read. Companies that inherited an application from an agency, a contractor or a team that left, and need to know what they now own.

Read-only access to one repository, as an invite to hello@aigrow.gg: the Read role on a GitHub organization repository, Reporter on GitLab or Read on Bitbucket. A repository under a personal GitHub account cannot grant read-only access, so send a zip export of it, with the .git folder if you can so we can read the history.

No. We read the code only: no penetration test, no scans of your servers or domains, no requests to your running application and no production credentials. Your tests run in an isolated copy on our side that cannot reach your systems.

The price covers one repository up to about 100,000 lines of application code, counted without tests, vendored libraries, generated files and lockfiles. For a larger codebase or several repositories, write to hello@aigrow.gg before you buy and we send a written quote. If we find after access that it is larger, we send the quote or refund you in full, your choice, before any work starts.

Critical: exploitable now with serious impact, such as an authentication bypass or a live secret in the code. High: exploitable under some conditions, or serious once found. Medium: weakens your defences or needs unusual conditions. Low: hygiene and hardening. Each finding also names its category in the OWASP Top 10:2025, the industry list of the most critical web application security risks.

No. They are estimates in engineer days, given as a range for each item, so you can plan the work and compare them with what a contractor quotes. This order does not include doing the work.

It gives you, your investors or your buyer a written view of the code with the evidence behind each finding. We do not promise how anyone will read it, or any effect on a valuation or a deal.

Yes, beside standard open source scanners. The AI coding tools we use run under commercial terms where the provider does not train its models on your code. Your code never goes to free AI tools, online scanners or upload sites, and every finding in the report is checked against the code by file and line.

It is used for your report only. We delete our copy 30 days after delivery, or sooner if you ask, and confirm the deletion in writing. You can remove our invite at any time.

Does your product include an AI chatbot?

The audit reads the code behind it. How the bot answers attackers in a live conversation is a separate test: the chatbot security test sends about 200 written attacks to the bot you authorise and reports each finding with the fix.

See the chatbot security test

The service that fits next

From $149

Security questionnaire answers

We answer the security questionnaire a customer sent you from your own documents, with the source of every answer and the questions only you can answer marked.

See the security questionnaire service

Know what is in your code before someone else reads it.

Pay once, give us read-only access to one repository, and get the written report within 10 working days.

Order for $490See every done-for-you service

$490 · paid once · delivered as listed or refunded