Audit Process

How a Service Ambercore mobile codebase audit moves from intake brief to annotated findings — without turning your week into theatre.

Stage 1 — Intake & scope lock

You send repository access details, platforms, release date, and a short list of worries (performance, crashes, agency handoff, payments, offline). We return a one-page scope: what is in, what is out, fee, and delivery date. Work does not start until both sides sign the engagement note.

Stage 2 — Repository familiarisation

The lead reviewer maps modules, build targets, and critical user journeys. A second reader skims for blind spots. We do not bill “hours of staring”; this pass exists to aim the deep review.

Stage 3 — Deep review

Depending on the engagement, we inspect architecture hotspots, dependency and build risk, test gaps, and release mechanics. Evidence is captured with file paths and reproduction notes where possible.

Stage 4 — Severity calibration

Blockers versus improvements are debated internally before you see the pack. Mild issues that will not threaten the release stay in a “later” appendix so the main list stays usable under pressure.

Stage 5 — Findings pack & live readout

You receive the written pack first, then a scheduled call. Bring the people who can change priorities. We leave with agreed next actions — even if the action is “ship with eyes open on X.”

Stage 6 — Optional remediation quote

If you want help fixing blockers, we quote that work separately. The audit recommendation does not depend on buying remediation.

Artefacts you keep

Findings pack (PDF or shared doc)
Severity-ranked issue list
Readout recording when both parties agree
Go/hold memo for readiness reviews

Ready to open stage 1?

Browse audit formats or send an inquiry with your release week.