Agency is handing over the code — is there a tool I can use to check the quality before accepting?

Automated tools run static application security testing (SAST). They easily catch SQL injection risks, exposed API secrets, and non-standard function structures. The first three metrics to check are: 'Critical Security Vulnerabilities', 'Code Duplication Rate' (under 5% is acceptable), and 'Unit Test Coverage'.

The tool might say the code follows best practices, but it has no idea whether the portal calculates VAT correctly when an order is placed. I've seen plenty of software pass static scans with zero errors only to botch the order total on its very first day in production. Don't rely solely on automation; real-world scenario testing is a must.

On our 15,000 Euro custom CRM project, we hired an independent expert to review the code for 600 Euro. The report uncovered an outdated PHP library and 4 queries that would have locked up the database. The agency fixed them with zero pushback. That 600 Euro saved us at least 3,000 Euro in future revision costs.

Check your contract. Is there a 30 or 60-day warranty or bug-fix clause post-delivery? Even if you pull a report from a code analysis tool and lay it in front of them, the agency can easily brush it off saying "the code runs fine" if the contract lacks binding clauses about code standards.

Don't try to play developer; just be upfront with the agency. btw tell them, "Per our company policy, we run all code through an independent static analysis tool and attach the report to the handover sign-off." Hearing that alone usually gets them to clean up the obvious junk in the code before delivery.

Can these tools also detect malicious stuff like viruses hidden in the code? And can we tell whether the agency actually wrote the project from scratch or just copy-pasted it off the internet?

Edit: asked below, I wrote the answer in the second message.

The minimum three things you should demand from the agency at handover: 1) A setup and run guide, 2) A license list of all open-source libraries used (must permit commercial use), 3) Deployment scripts proving the system can spin up from scratch in an independent environment.

I completely agree. btw don't hesitate to ask; those who don't ask always pay more.

Mistakes made on the source code analysis tool side are usually reversible but expensive. If you have questions, write them; I'll answer as best I can.

I went through the same thing.

i completely agree. like mistakes made on the source code analysis tool side are usually reversible but expensive.

weekly written progress reports are much more usful than asking for dates then btw hope this helps.

The most overlooked point about source code analysis tool is this: Everything goes well for the first three months; problems arise in the fourth.

That's all, sorry if I went on too long.

Correct.

You're right, I've been down that road too. The cheapest quote is usually the least thought-out one.

Just leaving this note, it might be useful.

You're right, I've been down that road too. If code ownership isn't in the contract, you have no bargaining power when leaving.

Proven by experience.

I disagree with you on this point. The biggest time-waster for us was not knowing who had the final say.

Thanks this was very helpful.

The discussion got scattered, let me summarize. When making decisions, write down the worst-case scenario too, not just the best.

Ask who prepared the quote and who will actually do the work.

The opposite happened to me, that's why I'm writing. When we decide without measuring, we always end up in the same place.

Correct me if I'm wrong.