03
AI Code Review
The code works. That's a different question from whether it's safe to put in front of users, and a different question again from whether you'll be able to change it in six months.
When this is worth doing
- Before a launch, when nobody technical has read the code.
- Before hiring, so you know what you're handing over.
- Before raising, when someone will do technical diligence on you.
- After a long AI-assisted build, to find out what accumulated.
- When you simply want a second opinion from a person.
What the review covers
- 01
Architecture
Whether the structure will hold as the app grows, or whether it's arranged in a way that makes every future change expensive.
- 02
Security
Authentication and authorization, exposed secrets, input handling, injection surfaces, what your deployment leaves open, and dependency risk. An engineering review — not a certified penetration test.
- 03
Performance and cost
The queries and calls that will hurt under real traffic, and anything that quietly runs up an infrastructure or API bill.
- 04
Maintainability
Whether a competent developer who has never seen this code could work in it. This is the one that decides what your next hire costs you.
How long it takes
Usually two to three days, depending on the size of the codebase and how deep you want the review to go. I’d rather read the code properly than skim it — a review that misses the important thing has cost you money for nothing.
Questions about this
Can you review AI-generated code before launch?
Yes, and it’s a good moment to ask. A pre-launch review covers architecture, security, performance, dependencies and maintainability, and comes back as a prioritized list rather than a wall of comments.
Can you review security?
Yes, as an engineering review rather than a formal audit or certification. I look at authentication, authorization, exposed secrets, input handling, dependency risk and what your deployment leaves open. If you need a certified penetration test, I’ll tell you that instead of pretending otherwise.
How does the first review work?
You send me what you have and describe what’s going wrong. I go through the application and the code, then come back with what I found, what I’d fix first, and what I’d leave alone. You get that in plain language, not a report you need a developer to interpret.
Your AI-built app doesn’t need another prompt.
Sometimes it needs an engineer.
Send the messy version. That’s usually the useful version.