Skip to main content

Codebase audits

Free source code audits

Find out what shape the software your business runs on is really in. Senior engineers read the code and tell you, in plain English, whether to keep it, fix it or rebuild it.

No fee, and it can come back saying your codebase is in reasonable shape.

What you haveYour codeSecurityGapsTestsMissingGrowthLikely to slowBusiness rulesNot written downWhat you get backYour auditRisksFix firstQuick fixesNextYour optionsThenYour teamFindings you can check with your own engineersKeep itFix itRebuild itYour auditFindingsWhat you haveYour codeSecurityGapsTestsMissingGrowthLikely to slowBusiness rulesNot written downWhat you get backYour auditRisksFix firstQuick fixesNextYour optionsThenYour teamFindings you can checkKeep itFix itRebuild itYour auditFindings

A source code audit is an outside check of the code behind your business software. It tells you what is broken, what is risky, and what to do about it. At The Gnar Company, senior engineers in the U.S. read the code, with help from an AI tool Gnar built, and explain what they find.

Kept private

We sign a privacy agreement (an NDA) first

Senior engineers

100% U.S.-based

No obligation

Use it with us or without us

The audit

What you get back.

Security holesFix firstMissing testsSecondSlows as you growThird
Security holesFix firstMissing testsSecondSlows as you growThird

The risks, worst first

Security holes, code that breaks when anyone changes it, and parts likely to slow down as you grow.

Quick fixesClose security gapsNowAdd missing testsNowBigger decisionsBig fixesDecideRebuild itDecide
Quick fixesClose security gapsNowAdd missing testsNowBigger decisionsBig fixesDecideRebuild itDecide

Quick fixes to start on

Small fixes your team can make now, kept separate from the big decisions.

What the code doesBusiness rulesExplainedOther systemsExplainedDataExplainedHow it fitsExplained
What the code doesBusiness rulesExplainedOther systemsExplainedDataExplained

What the code really does

Where nobody wrote down how it works, we explain what the main parts do.

Keep itOption 1Fix itOption 2Rebuild itOption 3And what each one would take
Keep itOption 1Fix itOption 2Rebuild itOption 3And what each one would take

Keep it, fix it, or rebuild it

Your options, and the next steps for each one.

Two ways in

Your own team’s code, or code someone left you.

What you need to know depends on who wrote the code.

Your own code

A second opinion on your own team’s code

You suspect something is wrong and cannot prove it. Your team tells us where to look first, and your engineers can check every finding.

Outside viewScaleCheckedSecurityCheckedTestsCheckedFindingsReady to check with your own engineers
Outside viewScaleCheckedSecurityCheckedTestsCheckedFindingsFor your engineers to check
Someone else’s code

Code someone else left behind

The company that built it left, or the people who built it moved on. We explain what the main parts of the code do, so the next team knows what it is working with.

Previous vendor’s codeDocumentationMissingTestsMissingThe next teamOurs or yoursCode explainedAudit
Previous vendor’s codeDocumentationMissingTestsMissingThe next teamOurs or yoursCode explainedAudit

Proof

Our work

Audit said: rebuild on newer technology

AARP Foundation tools that help older adults save on property taxes

40%fewer clicks to complete an application, on average
14tools rebuilt on React and Ruby on Rails
Read case study

Audit said: keep the system, build a new app

A new app for First Line Technology, built on the system it already had

4Xthe number of users
8,000+app users
Read case study

Audits, then upkeep on an older app

Keeping an older Fitbit app running and improving

Allclient commitments and service agreements met
Keptthe older app running and improving while Fitbit built the next one
Read case study
See all our work

How it works

How we’d work with you

We read the code before anyone talks about a rebuild.

NDASignedAccess to the codeGrantedFeeNone
NDASignedAccess to the codeGrantedFeeNone
Step 1 · No fee

You share the code, under NDA

We sign a non-disclosure agreement. Then you, or whoever holds the code, give us access. That is all it takes to start.

Your codeRead by senior engineersCodeDataOther systems
Your codeRead by senior engineersCodeDataSystems
Step 2

We read it

Senior engineers read the code, with help from our AI tool, and work out what the main parts do.

RisksFix firstQuick fixesNextYour optionsThen
RisksFirstQuick fixesNextOptionsThen
Step 3

You get a straight answer

A written audit, worst problems first, with what to do about each one. We walk your leaders and your engineers through it.

Our record

Why Gnar?

Common questions

Frequently asked questions

Still have questions?

Does The Gnar Company offer a free code audit?

Yes. The Gnar Company’s code audit is free. Gnar signs a non-disclosure agreement before it sees any code. Then senior engineers read it and send back what they found, worst problems first. You decide what to do next, with Gnar or without.

Why is the code audit free?

Because The Gnar Company reads existing code before it takes on any project. It does not charge for that. You get the findings either way, whether or not you hire Gnar. The audit also tells Gnar whether the code is something it can take on.

What does Gnar need from us to start the audit?

Two things: a signed non-disclosure agreement and access to the code. The Gnar Company signs the agreement first. After that, anyone who holds the code, such as a contractor or a past vendor, can share access. Your team can also tell Gnar where to look first.

What does a codebase audit include?

A Gnar code audit checks the code, how it is put together, and how it connects to your other systems. Senior engineers read it, and Gnar’s own AI tool checks it too. They look for security holes, missing tests and technical debt (old shortcuts that make every change harder). Gnar’s audit of the AARP Foundation’s property tax tools found security holes and missing tests.

Who reads our code?

Senior engineers at The Gnar Company, all based in the U.S. They read the code, helped by an AI tool Gnar built. Afterward, they take your leaders and engineers through the findings, so your own team can check each one.

Who can give us a ranked list of the security risks and technical debt in our code?

The Gnar Company can, for free. Its code audit ranks what it finds in your code, worst first. That includes security holes and technical debt (shortcuts that slow down every future change). You also get the quick fixes, listed apart from the bigger choices.

Can Gnar do an independent review of code another vendor built?

Yes. The Gnar Company audits code that another vendor built. It reads that code before agreeing to take any of it on. The AARP Foundation work started that way. Gnar checked tools a previous firm had built and took them over. Then it made them stable and moved them to a new platform.

What if the audit says to rebuild?

Then it says what to rebuild and what to keep. Take the AARP Foundation. The Gnar Company’s audit showed that a new platform would cost less than building on the old code. It also carried less risk. For First Line Technology, Gnar’s review said to keep the existing system. Gnar built a new app on top of it, which cost less than fixing the old app.

Do we have to hire Gnar after the audit?

No. The Gnar Company’s code audit does not commit you to anything. If your own engineers can make the fixes, the audit says so. If you want help with the rest, Gnar can do that too. It can move the software to a new platform, keep it running, or rewrite the parts that need it.

How do you modernize software when nobody documented it?

Start by understanding what the code does. In a Gnar code audit, senior engineers read the code. They work out the main business rules nobody wrote down, like how an order gets priced. If a rebuild follows, The Gnar Company turns the old code into a written plan for the new software. Then it builds from that plan. It does not copy the old code line by line.

How do I know if our codebase is ready for AI?

Ask three questions. Does the code have tests? Is it organized? Can anyone explain what it does? A Gnar code audit answers all three and ranks the gaps it finds. For AI across the rest of the business, The Gnar Company runs a separate, free AI Readiness Assessment.

Which tech stacks can Gnar audit?

The Gnar Company audits code in the stacks its engineers use every day. That means Ruby on Rails, React, Node.js and React Native, on AWS, Google Cloud and Azure. They have also read and rebuilt older PHP and Python software. If you are not sure what your system is written in, ask anyway. Gnar can tell once it has access to the code.

Your existing codeRead under NDA, no obligationCodeDataOther systemsDocs
Your existing codeRead under NDACodeDataOther systemsDocs

Start here

Start with a free read of your existing code.

The audit can come back saying your code is fine, and we will say so.

Ask for the code audit

Let’s Talk

Contact Us

Tell us what you’re trying to build or fix.