What the source code and engineering assessment shows you, view by view: what is really in the codebase, where the debt costs most, who the product depends on, and how each finding arrives with its fix. The 43% inventory is a real, anonymised result; the hotspots, people and findings are illustrative.
Headcount says nothing about how big a codebase is. Before any analysis we count effective lines, without generated code, vendored dependencies, binaries and duplicates. That number fixes the scope and the fee.
572,440 lines
572,440 lines across 4 repositories and 4,994 files. This is the number most quotes are built on.
243,761 lines of generated ORM migrations and designer code: 43% of the raw total, set aside from sizing and from review.
46,888 lines of test code, counted on their own and reviewed for coverage, not for size.
281,791 effective lines. Sizing on the raw number would have overstated the scope by about 2×.
Anonymised output from a prior assessment, shown for the shape of the output and the sizing logic, not as a price reference.
Complex code nobody touches can wait. Simple code that changes every week is fine. The risk sits where complex code changes often and matters to the business, so that is where the remediation plan starts.
Hotspot priority=complexity×change frequency×business criticality
Billing and the payment webhooks lead: complex, changed every week, and where revenue is calculated.
Illustrative data. Tools such as SonarQube express debt as remediation minutes; we validate and calibrate those estimates rather than present them as fact.
No assessment platform outputs this as standard, so we build it: every commit attributed to a person, ownership measured module by module, and the exposure to people who have already left. Choose who leaves, and see what is left uncovered.
A module is at risk when the people still on the team hold less than half of its code. Bus factor: the fewest people who together hold more than half. Illustrative data. In an assessment every Git identity is mapped to a real person, and contribution is measured by content, not line count.
AI does not set the final severity. A qualified reviewer confirms the evidence, the impact and the remediation before a finding enters the register, and each one comes with an effort estimate, an owner and a deadline.
F-017Severity: HighP1Validated by a reviewer
F-031Severity: HighP1Validated by a reviewer
F-044Severity: MediumP2Validated by a reviewer
Illustrative findings.
Ten business days from access, a fixed fee sized by the inventory, and the code stays where its owner wants it.
