Paid for a code audit and it's full of jargon, how do you read a code review report?

Focus on the security items tagged "Critical" and "High." In particular, if there are findings that fall under the OWASP Top 10 (like broken access control or SQL injection), these aren't code smells—they are direct gateways for data breaches that could constitute legal liability. There is no compromising on those.

The auditing firm owes you a 30-minute Q&A session. Ask them point-blank: "If this system went live tomorrow with 1,000 concurrent users, what are the top 3 items that would blow us up?" Hand only those 3 items to the agency.

That auditing firm you paid 4,000 GBP to probably just ran an open-source automated scanner on the code and slapped their logo on the resulting PDF to sell it to you. Are you even sure they manually reviewed the business logic?

With my first startup, I almost ended up in court with the agency over a similar report. Wherever it said "code smell," I assumed the system was about to blow up. Turns out the tool flagged it just because the function names didn't follow proper English grammar. Definitely get an expert to translate it for you before panicking.

Triage the items in this order: 1) Vulnerabilities affecting the database and customer security immediately, 2) Queries that cause deadlocks under concurrent traffic in the next sprint, 3) Formatting and documentation shortcomings only whenever there's downtime.

if u send the whole report to the agency they'll just get defensive and do nothing. like just take screenshots of the actual bugs tell them these breach our acceptance criteria and send those over.

is this "code smell" thing about servers overheating or hardware burning, or is it just a figure of speech programmers use among themselves?

Quick summary for newcomers: Mistakes made on the code review report side are usually reversible but expensive.

Just leaving this note it might be useful.

I went through the same thing two years ago. Solutions that work at a small scale collapse when you grow; I learned this late.

This is my opinion I'm not claiming it's absolute truth.

I'll try it.

Timely topic.

The discussion got scattered, let me summarize. People defend habits not processes. Resistance comes from there.

We got stuck at the same point for a while. Implementing a change request process doesn't slow things down, it speeds them up.

Mistakes made on the code review report side are usually reversible but expensive.

My questions are cleared up, thanks.

saved.

The most overlooked point about code review report is this: Access credentials should be opened in the company's name, not personal accounts.

You're right.

this thrad is archived.