Security · Performance · Technical debt

Rails code audit Know what your Rails app is really worth, before you decide what to do with it.

Our Rails code audit is an outside, independent review of your Ruby on Rails application, delivered as a written report with fixes ranked by priority and estimated. Before a takeover, a fundraise or an acquisition, or when every release breaks something, the audit gives you facts instead of opinions.

Request an audit What the audit covers
  • 100+ projects delivered
  • 8 years of experience
  • 98% satisfied clients
  • 48h reply time

Scope

What a Rails code audit covers

Six areas, reviewed against your actual code and production environment. Every finding is explained, located in the code and given a risk level. The audit is run by the developers of our Ruby on Rails agency, who build and maintain Rails apps every day.

Code quality and architecture

Fat models, controllers that do everything, cascading callbacks, business logic scattered everywhere. We assess readability, how closely the code follows Rails conventions and how easily it can evolve.

Security

Static analysis with Brakeman, known gem vulnerabilities, secrets committed to the repository, sessions, authentication and access rights, SQL injection, XSS and unfiltered parameters.

Performance

N+1 queries, missing or useless PostgreSQL indexes, slow queries, missing caching, heavy work done during the request instead of in background jobs. We find the pages that cost you the most.

Tests and safety net

Real coverage of critical flows, reliability of the suite (flaky, slow or disabled tests) and whether continuous integration runs them. Code without reliable tests costs more with every change.

Dependencies and versions

Ruby and Rails versions, abandoned or forked gems, dependencies that block an upgrade. We measure the gap with Rails 8 and Ruby 3.4 and what it would take to close it.

Deployment and infrastructure

Release process, database backups and restores, monitoring, error handling and environment configuration. We spot single points of failure and risky manual steps.

When to order one

Four situations where an audit pays for itself

An audit is a short engagement compared with what it protects. Clients usually come to us at one of these moments.

Before taking over an app

You are changing provider or bringing development in-house. The audit tells the new team what they are inheriting and where to be careful.

Before a fundraise or an acquisition

Investors and buyers want to know the technical debt and the security risks. The report gives them a clear, documented view.

When things keep breaking

Slow pages, failed jobs, regressions with every release. We trace the symptoms back to their causes in the code and the infrastructure.

Before a version upgrade

An old Rails version is one of the most common reasons to ask for an audit. We map the path, then you decide who carries out the Rails upgrade.

Our method

How a Rails audit works

Four steps, a scope agreed upfront and a deliverable you can pass as is to a CTO, an investor or a new provider.

  1. Scoping and access A call to understand the context: a handover, due diligence, slowdowns or incidents. You give us read access to the repository and, ideally, to your monitoring. You receive a quote with the scope of the audit.
  2. Automated analysis Brakeman, bundler-audit, static analysis, a read-through of the database schema, running the test suite and measuring coverage. The tools give a first map of the risks.
  3. Manual review A senior Rails developer reads the code behind your critical flows: payments, authentication, permissions, imports, jobs. That is where the real problems hide, the ones no tool can see.
  4. Report and debrief A written report with an executive summary, detailed findings for the technical team and an action plan ranked by priority, with an estimate for each fix. We walk you through it on a video call.

The deliverable

A report built for decision-making

A structured document that answers two questions: what to fix first, and what each fix will take.

Executive summary

A short summary you can read without being a developer: overall health, major risks and the effort needed to get the application back on track. Useful for a board, an investor or a buyer.

Prioritised, estimated fixes

Every item is rated critical, important or nice to have, and every fix comes with an estimate. You know what to tackle now and what to plan for later.

Your call on what comes next

The report is yours and any Rails team can act on it. If you prefer, we can take on the fixes, the upgrade or the maintenance.

Case study · we audit what we know how to build

Le Baroudeur du Vin: a Rails OS in production

To audit a Rails application well, you need to have built and run one. Le Baroudeur du Vin is an online wine shop: we built its e-commerce site and SEO strategy, then an internal OS in Ruby on Rails that runs invoicing, inventory, logistics and the product catalog.

Stack
Ruby on Rails · PostgreSQL · Hotwire
Services
Rails business app · e-commerce · SEO
Why it matters
We know where business apps break
Talk about your application
Le Baroudeur du Vin online wine shop, run by an internal Rails application
The storefront. Stock, invoices and shipping run in Rails.
  • InvoicingTotals, taxes and numbering: where a wrong rounding becomes a legal issue.
  • InventoryConcurrent sales and deliveries: where race conditions hide.
  • LogisticsBackground jobs that must never fail silently.
  • Product catalogData that feeds the shop and must stay consistent.

Frequently asked questions

Your questions about auditing a Rails app

How much does a Rails code audit cost?

The audit is quote-based. The price depends on the size of the codebase, the number of services and how deep you want us to go. After a first conversation and a look at the repository, we send you a quote with a clear scope.

How long does a Rails audit take?

It depends on the size of the application and the depth you need, and the timeline is stated in the quote. If you have a deadline, such as a fundraise, a deal closing or a change of provider, tell us at the start and we will adapt the scope to it.

What access do you need?

Read access to the Git repository is enough to get started. For the performance review, read access to your monitoring tool and logs helps a lot. If needed, we work on an anonymised copy of the database rather than production data.

Can the audit be used for due diligence before an acquisition or a fundraise?

Yes, it is a common case. The report gives the buyer or investor a clear view of the technical debt, the security risks and the cost of bringing the application up to standard. We can also present the findings to the stakeholders.

Do we then have to hand the application over to Akolads?

No. The report belongs to you and any Rails team can use it, in-house or external. If you wish, we can then take on the fixes, a version upgrade or the maintenance.

Our application runs on an old version of Rails. Is that a problem?

No, it is one of the most common reasons to request an audit. We assess the gap with Rails 8 and Ruby 3.4, the gems that block an upgrade and the security risks of unmaintained versions, and the report sets out a step-by-step migration path.

Our other Rails services

More ways we can help with Rails

Every service below is run by the same team. For the full picture, see our Ruby on Rails agency page.

Rails MVP development

Accounts, Stripe subscriptions, an admin back office and your core feature, live in a few weeks.

€8,000 to €20,000

Rails upgrade services

Take over a legacy Rails app, cover it with tests and bring it to Rails 8, one version at a time.

Custom quote

Rails maintenance services

Security patches, updates, monitoring and small improvements for your app in production.

Custom quote

Get your Rails application audited

Tell us about your application and your context. We reply within 48 hours with a proposed scope and the next steps.

Get a free quote Book a call