# What is a code audit? Source: https://www.plutonapps.com/resources/what-is-a-code-audit Published 2026-09-30, updated 2026-10-24, sources checked 2026-10-24. By Irfan Habib (https://www.plutonapps.com/authors/irfan-habib). **Code audit:** A code audit is a structured review of a whole codebase by experienced engineers, looking for security holes, reliability risks and code that will be hard to change. It ends in a written list of findings ranked by risk. Unlike a code review, which checks one change before it merges, a code audit looks at everything that already exists. Also known as: Source code audit, Codebase review. Before you raise money, hire a team or put real users on an AI-built app, someone should read the code. This is what that reading covers. ## What does a code audit answer that the screens cannot? An AI-built app has usually never been read by anyone. An audit is the first reading, and it answers the questions the screens cannot: who can reach which data, what happens on a retry, where the secrets are, what breaks if two people act at once. ## Which areas does a code audit check? A code audit checks five areas: access control, which is first on the OWASP Top 10:2025; secrets and configuration; data, including row-level security, migrations and backups; reliability, such as retries, duplicates and error handling; and maintainability, meaning tests, duplication and dependencies. Each finding is ranked by risk: - Access control: broken access control is first on the OWASP Top 10:2025. - Secrets and configuration: keys in client code, permissive defaults. - Data: row-level security, migrations, backups. - Reliability: retries, duplicates, background work, error handling. - Maintainability: tests, duplication, dependencies. > **What we see in practice** In the Zulu prototype, six of twelve meeting operations matched on an id alone, and two token signers fell back to a public key or a fixed string when a secret was missing. The [Zulu case study](https://www.plutonapps.com/work/zulu) lists each risk beside what replaced it. ## How does a code audit of a Lovable and Supabase app work? Start with the automated checks, then read the code by hand. Lovable's quick scan reviews the database, dependencies and MCP servers on every publish, and its deep scan looks at access control, secrets and authentication. Lovable itself says these tools cannot guarantee complete security, so apps handling sensitive data may need a professional review. 1. **Run the tools first** Lovable's scans, a dependency audit and our [exposed key checker](https://www.plutonapps.com/tools/exposed-key-checker) catch known patterns quickly, so human time goes to judgment. 2. **Map who can reach what** List every table and server function, and check each against the rules the product needs. Missing [row-level security](https://www.plutonapps.com/resources/what-is-row-level-security) shows up here. 3. **Read the risky paths** Sign-in, payments, file uploads and anything that sends email or changes another user's data. 4. **Rank the findings** Write each one down with what could happen, how likely it is, and the fix. ## Which OWASP risks does a code audit look for beyond access control? The OWASP Top 10:2025 gives an audit its checklist. After broken access control come security misconfiguration, software supply chain failures, cryptographic failures and injection. The list also covers insecure design, authentication failures, data integrity failures, logging and alerting failures, and mishandling of exceptional conditions such as errors and retries. An audit tells you what is wrong; it does not fix it. If you want both, our [vibe coding rescue](https://www.plutonapps.com/services/vibe-coding-rescue) starts with a review of what exists, then makes the fixes. For a quick first look before that, try the [production readiness check](https://www.plutonapps.com/tools/production-readiness-check). ## Frequently asked questions ### What is the difference between a code audit and a code review? A code review checks one change before it is merged. A code audit reviews the whole existing codebase at once and reports its risks. An audit ends in a written list of findings ranked by risk, covering access control, secrets, data, reliability and maintainability. ### Can AI audit code? Tools help find known patterns quickly. Judging access rules and business logic still takes an engineer who understands what the app is meant to allow. Access control, first on the OWASP Top 10:2025, depends on knowing who should reach which data. ### When does an AI-built app need a code audit? Before real users, real payments or sensitive data reach it, and before you raise money or hand it to a new team. Lovable's own documentation says its scans cannot guarantee complete security, and that apps handling sensitive data may need a professional security review. An audit is that review. ## Read next - [Production readiness check for your app](https://www.plutonapps.com/tools/production-readiness-check) - [Vibe coding rescue: a review of what exists, then the fixes](https://www.plutonapps.com/services/vibe-coding-rescue) - [The Zulu case study: each prototype risk beside its fix](https://www.plutonapps.com/work/zulu) - [Which rules your product actually has to meet](https://www.plutonapps.com/resources/which-rules-your-product-must-meet) ## Sources - [OWASP Top 10:2025](https://top10.owasp.org/2025) - [OWASP Code Review Guide, Version 2.0 (2017)](https://owasp.github.io/www-project-code-review-guide/assets/OWASP_Code_Review_Guide_v2.pdf) - [NIST SP 800-218: Secure Software Development Framework (SSDF) Version 1.1 (February 2022)](https://csrc.nist.gov/pubs/sp/800/218/final) - [Lovable documentation: Security](https://docs.lovable.dev/features/security)