Know what is healthy, what is risky, and what to fix next.
An iOS code audit gives you an independent technical view before a handover, investment, major roadmap commitment or modernisation project. The result is not a generic score: it is a prioritised decision document grounded in your app and your business context.
What I look at
Each lens is applied against your app and roadmap, not against a generic checklist. Where a lens is not relevant to your product, I say so rather than padding the report.
- Build reproducibility and release readiness.
- Architecture, module boundaries and the cost of change.
- Swift and Objective-C code quality.
- Concurrency and thread-safety, including Swift 6 readiness.
- Dependency health and supply-chain exposure.
- Networking, persistence, error handling and offline behaviour.
- Security-sensitive storage and data flows, at a code-review level.
- Test strategy and CI/CD reliability.
- Performance risks and observable production evidence.
- Accessibility, privacy and App Store maintenance risks where relevant.
What an audit is not
This is an expert engineering review. It is not a formal penetration test, a legal compliance certification, or a guarantee that no defect exists. Specialist security testing should be separately commissioned when required.
Being clear about that boundary is part of the value. A report that implies more assurance than it can support is worse than no report, particularly if it is going in front of an investor or a board.
What you receive
- A concise executive summary for non-iOS decision-makers.
- Evidence-backed findings grouped by criticality and business impact.
- A “fix now / plan next / monitor / leave alone” roadmap.
- Specific examples and recommended approaches, not abstract principles.
- A debrief call and a period for follow-up questions.
- An optional implementation proposal, kept separate from the findings.
How the engagement is shaped
- Focused reviewA bounded question or a smaller codebase. Usually 2–3 consulting days.
- Full codebase auditA broader architecture and delivery review. Commonly 5–8 consulting days.
- Audit plus remediationScoped separately after the findings, so the audit stays useful on its own terms.
What it is likely to cost
As a planning guide, a professional single-platform iOS audit commonly falls between roughly £2,500 and £7,500, depending on codebase size, build complexity, the evidence available and the depth required.
This is an indicative range, not a quote. A tightly bounded review may cost less; a large multi-module or regulated app may require a custom scope. Any applicable VAT will be confirmed in the proposal. For a fuller breakdown of what moves the number, see how much an iOS code audit costs.
Relevant experience
Why this work suits me
At Westpac I sit in the core architecture team of a national banking app, setting iOS technical standards: modular boundaries and dependency rules, the UIKit-to-SwiftUI migration path, and how Swift 6 strict concurrency is adopted across a large, long-lived codebase.
Before that I spent two years as the sole engineer on a commercial iOS SDK that had to pass tier-one banks' own security reviews, and several years at Waracle assessing and working inside large client codebases I had not written. Judging an unfamiliar codebase quickly, and being honest about what the evidence does and does not support, is the substance of this service.
Common questions
What access do you need?
Read access to the repository, whatever build and configuration instructions exist, and an hour of context from someone who knows the product. Access to crash reporting, analytics and App Store Connect makes the findings considerably stronger, but is not essential to begin.
How long does an audit take?
A focused review is usually 2–3 consulting days and a full codebase audit commonly 5–8, spread over a slightly longer calendar period to allow for questions and the debrief. Large multi-module or regulated apps are scoped individually.
Can you audit an app that does not build?
Yes, but restoring the build usually becomes the first piece of work, because a codebase you cannot run gives you far less evidence. If that is likely, I will say so upfront and we can time-box the recovery separately rather than letting it consume the audit.
Will you sign an NDA?
Yes. I work with commercial codebases routinely and am comfortable with a standard mutual NDA before receiving access. Confidentiality obligations are also written into the engagement terms.
Is this the same as a security penetration test?
No. This is an expert engineering review. I will flag security-sensitive code and obvious risks in storage, authentication and data flow, but a penetration test is a different discipline with different tooling and a different kind of report. If you need one, commission it separately from a specialist security firm.
Can our own team implement the recommendations?
Yes, and that is often the right outcome. The report is written to be actionable by an internal team, with enough evidence and sequencing that someone who did not sit in the audit can pick it up. Implementation help from me is optional and quoted separately.
What does an audit cost?
For planning purposes, a professional single-platform iOS audit commonly falls between roughly £2,500 and £7,500 in the UK, depending on codebase size, build complexity, available evidence and required depth. That is an indicative range rather than a quote.
Related reading
Considering an independent review?
Tell me the size of the codebase, whether it builds, and what decision the audit needs to support. I will reply with a scope and, where the work allows one, a fixed price.