Audit against business risk, not taste
The trap is auditing for code style — the stuff that generates a long, useless list. A good audit ranks findings by business impact: what could cause a breach, an outage, a runaway bill, or an inability to ship. A messy file that works and rarely changes is near the bottom; an auth gap or an endpoint that falls over at 2x traffic is at the top.
The five lenses
- Security: authn/authz correctness, tenant isolation, secret handling, injection surfaces, dependency vulnerabilities.
- Scalability: where it breaks at 10x — the database first (queries, indexes, connections), then synchronous work that should be queued.
- Performance: Core Web Vitals and slow endpoints, since they directly cost conversions and retention.
- Cost: infrastructure and third-party/AI spend that scales worse than revenue — the silent margin killer.
- Delivery: can the team ship safely — tests, CI/CD, observability, and how scary a deploy feels.
How I actually do it
I combine three views. Read the code around the money paths (auth, billing, the core workflow) where bugs hurt most. Look at the data model and the slow queries, because that's where early-stage SaaS breaks first. And talk to the team — 'what are you afraid to touch?' and 'what breaks at 3am?' surface the real fragility faster than any static scan. Tools (a dependency audit, a bundle analyzer, EXPLAIN on hot queries) fill in the measurable gaps.
The most valuable audit output isn't the list of problems — it's the priority order. A founder can act on 'fix these three things this month'; they drown in 'here are 60 issues.'
Deliver a plan, not a verdict
The report ends with a sequenced roadmap: critical fixes (security, imminent scaling walls) now, high-impact improvements next, and a 'later / acceptable' bucket named explicitly so nobody wastes time on it. Each item gets the why and the rough effort, so the founder can weigh it against shipping features. That's the difference between an audit that gets acted on and one that gets filed.
Key takeaways
- Rank findings by business risk — breach, outage, runaway cost, can't-ship — not code style.
- Assess through five lenses: security, scalability, performance, cost, delivery.
- Combine reading the money-path code, inspecting the data model, and asking the team what they fear.
- Deliver a prioritized roadmap with why + effort, including an explicit 'acceptable for now' bucket.