Independent code quality audits
Know where your code is weak, and what to fix first
- Every finding with its location, its cause and its class: what a tool can catch, what only review finds, and the checks your project is missing.
- Recommendations in priority order.
- Six axes graded from 1 to 10: Architecture, Performance, Consistency, Security, Documentation, Correctness.
Whether people or AI agents wrote the code.
Audits cover public GitHub repositories. For private code, talk to us.
One review, two results
Each review of a repository produces a public evaluation and a private audit report. They do different jobs.
| Aspect | Evaluation | Audit report |
|---|---|---|
| Purpose | Follow a repository over time | Understand the code and decide what to fix |
| Content | Metrics: a score out of 100, six axis grades, finding counts | Every finding explained, recommendations in priority order, and the same metrics |
| Confidentiality | Public | Private: it describes weaknesses, some of them exploitable |
| Form | A repository page and a README badge | A report delivered to you |
Evaluations are published by default. The owner of a repository can ask for its evaluation to be removed through the contact form.
Public evaluation: github.com/arhuman/kwalitai
Metrics only. The audit report of the same review holds each finding with its location, its cause and a recommendation.
78/100
- architecture 8/10
- performance 7/10 weakest axis
- consistency 8/10
- security 8/10
- documentation 8/10
- correctness 8/10
Findings by axis
| Axis | tool-detectable | found by review | check gaps |
|---|---|---|---|
| architecture | 0 | 0 | 0 |
| performance | 2 | 0 | 1 |
| consistency | 0 | 0 | 2 |
| security | 3 | 2 | 4 |
| documentation | 0 | 0 | 0 |
| correctness | 0 | 2 | 0 |
Fix the weakest area first
Each axis is graded from 1 to 10, and the score is capped by the weakest one: a repository cannot hide one poor axis behind five good ones. See what the six axes measure.
See what your tools miss
Every defect is classed as tool-detectable or found by review, and the quality checks your project is missing or not running are counted apart.
Examples of what audits find: missing HTTP server timeouts, database queries inside loops, CI actions pinned by tag instead of commit, complexity limits set one step too loose.
Read change honestly
A change between two evaluations is shown as a number only when both used the same method. Otherwise the page says the method changed instead of comparing unlike things.
The audit report
For one public repository, 490 EUR. The price includes one follow-up verification after your fixes. The report holds the findings themselves (where they are and why they matter), classed, with recommendations in priority order, along with the metrics of the evaluation. It stays private because it describes weaknesses, some of them exploitable. See the audit offer.
A score you can recompute
The score out of 100 comes from the axis grades by a published rule, and is always shown with the commit and the method that produced it. Read the method.