PHP Upgrade and Modernisation
Move old PHP 5.x and 7.x applications to a supported PHP 8 in tested steps, with AI-assisted analysis, while the application keeps running.
Learn more Services
AI-assisted code and security review with a prioritised fix list
Most codebases hold problems their owners have not seen yet. We review yours with AI-assisted tools, a person checks every finding, and you receive a clear, prioritised list of what to fix first.
What it is
AI-Assisted Code and Security Review: what you get
A code and security review looks through your application for weaknesses: input that is not checked, access rules that can be bypassed, secrets left in the code, outdated libraries, fragile error handling and design choices that will cause trouble later. AI-assisted tools read a large codebase quickly and flag candidates. A person then checks each one, throws out the false alarms and judges what really matters.
The result is a written report with findings ranked by risk and effort, each with an explanation and a suggested fix. Reviews can be repeated in rounds: fix the top items, review again, and watch the list shrink. If you want, we can make the fixes ourselves; if you prefer, your own developers can work from the list.
To be clear about scope: this is a review of your code by a software developer, supported by AI. It is not a formal penetration test, and it is not a compliance audit. If you need either of those, you will need an accredited specialist, and we can help prepare the application for it by fixing what the review finds.
Problems we solve
Typical problems this solves
Code nobody has reviewed
Applications grow for years without a second pair of eyes. A review gives an independent view of what is there.
Worry about a known weakness
You suspect old libraries, weak logins or unsafe forms. We check, confirm or rule out, and tell you how serious it is.
Too many findings and no order
Automated scanners produce long lists with many false alarms. A person sorts them into what to fix now, soon and later.
A server that was compromised
After a break-in, the application and the server both need cleaning and hardening so it does not happen the same way again.
Inherited code from another developer
Before you build on it, find out what condition it is in and what it will cost in effort to make it safe.
Deliverables
What we deliver
- AI-assisted review of the code, configuration and dependencies in the agreed scope
- Every finding checked by a person, with false alarms removed
- A written report ranked by risk and effort, with plain-English explanations
- A prioritised fix list your developers or we can work through
- Optional fixing of the findings, and a follow-up review round
- Where needed, security clean-up and hardening of the server the application runs on
Technologies we use
- AI-assisted code analysis
- Static analysis
- Dependency checks
- PHP
- Python
- JavaScript and TypeScript
- SQL injection and XSS checks
- Authentication and access control review
- Secrets and configuration review
- Linux server hardening
- Git
We work in any language. See all technologies.
Built and running
Work we have built and run
Examples from our own work, described without client names.
- AI-assisted code and security reviews of our own product, repeated in several rounds and turned into fix lists.
- Server security hardening and clean-up on a live production server.
Engagement
How the engagement works
It starts with a free consultation, where you tell us what the application does, what language and framework it uses and what worries you. We agree the scope and give you a written estimate before any work begins.
We then review, check the findings and deliver the report. You decide what happens next: fix it yourselves, ask us to fix it, or run a second round after the fixes to confirm the list has shrunk. Your code stays with you, and we treat it as confidential.
Questions
Common questions
Is this a penetration test?
No. It is a review of your code, configuration and dependencies. It is not a formal penetration test and not a compliance audit. If you need either, an accredited specialist is the right choice.
Does AI decide what is a problem?
No. AI helps us read a lot of code quickly and flag candidates. A person checks every finding before it appears in your report.
Will our code be sent to an AI provider?
We agree this with you first. Where the code is sensitive, we can use models you host yourself or limit what is shared. Your legal adviser has the final word on what may leave your premises.
Can you fix what you find?
Yes, if you want. Many clients take the fix list to their own developers, and others ask us to make the fixes and run a follow-up round.
What do you review in practice?
The application code, its dependencies, its configuration and, if you wish, the server it runs on. We agree the exact scope at the start.
How do you charge?
We do not publish prices. After a free consultation we give you a written estimate, so you know the scope before you commit.
Related
Related services
Software Maintenance, Support and DevOps
We take over existing code, fix bugs, monitor, patch and run Linux servers, backups and hosting.
Learn moreLegacy Software Modernisation
Upgrade old PHP, .NET, VB and desktop applications, migrate databases and move to the cloud while the business keeps running.
Learn moreFurther reading: How much does custom software cost? What actually drives the price
Tell us what you need built
Describe the problem, the system or the idea. We offer a free initial consultation and a written estimate, and you will talk directly to the developer who would build it.