AI codebase audit
two weeks · €10,000 fixed · from Berlin, across Europe
Far Horizons audits a whole codebase in two weeks for a fixed €10,000. AI reads all of it, and every finding it makes is checked until it can be tied to a file and a line. It's for CTOs, CEOs and investors who need a straight answer about a system: can we replatform it, is it safe to let coding agents work in it, or what are we buying.
01
Reverse-engineer the system
days one to three · read-only access
The AI reads the entire codebase and writes a technical spec and a product requirements document: what the system actually does, path by path. On a large legacy estate that is hundreds of sub-agents, one per external path. It gets read-only access to analytics and observability too, so it can tell which parts are used and which nobody has touched in years.
02
Check it with your engineers
first week · a few hours of their time
Some of what the AI writes will be wrong, and some of what looks wrong turns out to be a feature everyone forgot. Your engineers correct it, and the gaps show where knowledge only lives in someone's head. Then most of the time goes on the two or three subsystems that would be catastrophic if they failed for what you're trying to do.
03
Prove every finding
second week · two models
The same audit runs on two different models, because they miss different things. Each serious finding gets a deeper pass to see if it's real. A finding goes in as fact only if it can be pointed at by file and line and another engineer would agree. If it's serious but can't be proved from the repo, it goes on a spike list to check, still marked serious.
04
Hand over
end of week two · a call and a report
You get a verdict on the question you came with, the findings as tickets with their evidence, how bad each one is and how sure, the spike list, and a list of what was not probed. There is a written report with an executive summary, but the point is tickets someone owns, not a document in a drawer.
Why AI, and why it still needs checking
A person can't read half a million lines in two weeks. AI can, but it goes shallow, and it's confidently wrong often enough that an unchecked AI audit is worse than none. In one audit the AI marked a scoring bug fixed, and months later someone posted a forged score through it. So every severe finding gets checked by hand, and anything that can't be proved from the code is labelled as unproved.
Who leads it
Far Horizons OÜ is the AI engineering practice of Luke Chadwick, based in Berlin. He has shipped software since 2001, built production LLM systems since 2022, and still writes code with agents every day. There's more on the about page.
Before you write
How much does it cost?
€10,000, fixed, for two weeks. It is scoped and priced before anything starts.
What questions does it answer?
Usually one of three. Can we replatform this, and what would we lose? Is it safe to point coding agents at it? Or, before an investment or acquisition, what are we actually buying? The audit is scoped around your question, so the verdict answers it directly.
Is it safe to point AI coding agents at our codebase?
It depends on the tests and the seams more than the code. A well-factored codebase with lots of tests, clear seams and a CI that can tell when work is done supports agents well. A legacy estate with little coverage and unclear seams can still use them, but they'll need hand-holding. The audit checks this directly: could an agent get something wrong through your CI, and how long does a human take to verify a PR?
Is this a penetration test or a legal review?
No. Security findings are traced through the code, and the serious ones are stepped through to check they are real, but nobody attacks your live systems. Anything that needs the live system, and any legal question, goes on the list of what was not probed.
Who does the work?
Luke Chadwick, who has shipped software since 2001 and built production LLM systems since 2022. There is no hand-off to a junior team. He works from Berlin with companies across Europe.
What happens after the audit?
Your team can work through the tickets on its own. If you want help, the usual next step is two to five days of team enablement on your repo. The audit is also the cheapest way to find out if Far Horizons is a fit for anything bigger.
Further reading
Write to hello@farhorizons.io with the question you need answered and roughly how big the codebase is. You'll hear back within a business day with whether the audit fits and when it could start.