Self-audit your codebase against the same ten patterns we run on every paid engagement — no email gate, no paywall — or have an independent senior voice write the brief in five days.
These ten patterns are the same ten we run on every paid audit. Nothing held back. Run them against your own code, tick what you have, note what’s missing.
Her seed lead’s CTO had sent a one-line email: “send us the architecture brief and the ADRs before the call.” There were no ADRs. There was no diagram. The MVP had been built in Cursor and Lovable over a frantic eight weeks, and nobody had written down a single load-bearing decision.
She didn’t need a rebuild. She needed to know what an acquirer’s CTO would ask, in advance, in plain words. So she ran her code against this library. Ten patterns. Tenant isolation, idempotent payments, an audit log on every mutation, a threat model on the top eight abuse paths.
She found six gaps, fixed four herself, and booked us for the two that needed a senior pair. The brief shipped on the Friday. The diligence call lasted forty minutes instead of two days. This page is for founders walking into a room they can’t bluff.
They surface in eight of every ten audits we’ve done across 47 engagements. Open any row. Tick what you have. Note what’s missing.
Row-level security in Postgres or per-tenant collection in Mongo. Tested with the IDOR playbook. One URL parameter change cannot return another tenant’s data.
Token expiry, refresh rotation, no anon-key fallback, MFA path stubbed. Session invalidation on password change. CSRF on every mutation.
Stripe or GoCardless webhook handlers idempotent. Idempotency keys on every POST that touches money. Reconciler runs nightly. Double-charge architecturally impossible.
Who changed what, when, before-value, after-value. Exportable per workspace. SOC-2 and ISO 27001 audits become paperwork, not panic.
STRIDE + MITRE ATT&CK applied. Spoofing, tampering, repudiation, info disclosure, DoS, elevation. What we tested. What passed. What needs work.
k6 simulation at 5 to 10× expected peak. What breaks first. Where the connection pool maxes out. Where the queue backs up. The capacity number in the runbook.
Trace ID per request. Sentry catches errors with user + tenant context. Datadog or CloudWatch metrics. Runbook for the top 10 alerts. On-call answers within an hour, not a day.
Every paid event (LLM call, email, SMS, storage, Stripe fee) logged with tenant ID. Cost dashboard live. Two customers being 60% of the LLM bill becomes a known fact, not a mystery.
RTO + RPO defined. Multi-AZ on the DB. Backup tested by restoring to staging in the last 90 days. Single-region failure plan documented.
Architecture decision records covering the load-bearing calls. A one-page system diagram in the repo. An onboarding video. Your next senior hire reads it on day one and ships on day two.
Fixed scope, fixed price, brief on the Friday. The same shape on every engagement since 2019. Self-audit with the library first, then book us for the gaps that need a senior pair.
NDA signed inside 30 minutes, read-only access granted, the clock starts. We map the system before we touch a single decision.
Tenant isolation, idempotent payments, an audit log on every mutation, a threat model on the top eight abuse paths. The same ten we publish free.
Every critical finding is confirmed in staging, not asserted. A finding leads with the risk in plain words, then the observed behaviour.
The fix-list comes ordered by severity with an effort estimate against each line. You fix the cheap criticals; we take the senior pairs.
A 30-page written brief, a one-page system diagram, six ADRs drafted. It survives Series A and acquirer review, not a Notion page.
Finding 04 of 14. Severity: critical. This is the exact shape of every line in the written audit, not a Notion page.
“Tenant isolation bypassable with URL parameter modification.”
A finding leads with the risk, not the jargon. Anyone on the diligence call can read the title and know what’s at stake before the detail.
“A trailing slash on another workspace ID returned that tenant’s invoices.”
The membership check used string-equality that treated a trailing slash as equivalent. We confirmed it in staging: customer A’s token listed customer B’s invoices.
“Direct PII + financial data disclosure across tenants.”
Material in any SOC-2 audit, GDPR breach assessment, or acquirer technical diligence. The brief states the consequence in the terms your acquirer’s lawyers use.
“Enforce row-level security at Postgres. Replace string-equality with a strict UUID match.”
Sample RLS policy in the appendix. Add an integration test for the trailing-slash case. Effort: one senior engineer, three working days.
“Re-run the staging IDOR test post-remediation.”
Production deploy behind a feature flag. An audit-log query confirms zero cross-tenant access in the 30 days following. The fix is closed with evidence, not a hope.
CTOs, founders, and engineering leads run this checklist differently. Pick yours, then book us for the gaps that need a senior pair.
Patterns published, free
Brief on the Friday
“The diligence call lasted forty minutes instead of two days. This page is for founders walking into a room they can’t bluff.”
Walk your codebase against the ten patterns. Mark the misses. You now have a prioritised list. Most teams find six gaps, some find three, a few find none.
Your seed lead or acquirer’s CTO will ask about exactly these ten things. Run the library first. Walk into the call with the answers ready. The questions get shorter.
Sending it to an external developer or agency before they quote? The ones who don’t recognise eight of the ten patterns are the ones who’ll miss them in your code.
A diligence call under six weeks out and no time to self-audit, write the brief, and produce the diagram. We ship a 30-page brief and a one-page diagram by Friday.
They walk into the brief and ADRs, not a wiki from 2022. An onboarding video recorded. First architectural call by week three, not month three.
It was built in Cursor, Lovable, or Claude Code, it broke under load, and you don’t know what to fix first. The audit ranks the fix-list by severity, with effort against each.
Studio-wide aggregate across seven years and 47 audits. Auditable, verified at every M&A diligence we’ve been part of. Numbers, not adjectives.
Role-anonymised lines from teams who self-audited first, then booked the five-day audit.
The diligence call lasted forty minutes instead of two days. We walked in with the brief, the diagram, and the ADRs ready.
Pain-first, soft-second.
Yes. The ten patterns above are the same ten we run on every paid audit. Nothing held back, no email gate, no PDF download for “exclusive content”. The paid audit ships the senior engineering attention applied to your codebase, the written brief, the diagram, the ADRs, the walkthrough. That’s what you’re paying for. The architecture patterns library itself was never the moat.
Because senior engineers reading your specific codebase for five days find things a checklist can’t predict. The library tells you what to look for. The audit tells you what we found. The written brief tells your acquirer’s CTO what passed. About a third of our paid-audit clients run the architecture audit checklist first, then book the audit anyway. It pays back inside the first quarter.
Yes. We’d genuinely like more UK engineering studios to publish their audit patterns. Architectural transparency raises the floor for every founder. Credit Empyreal if it’s a straight fork. Adapt freely if you’re reshaping it for your stack.
Roughly quarterly, or when a new pattern surfaces in three or more audits in a row. The current ten have been stable since early 2025. We’re tracking two emerging patterns, LLM cost attribution per tenant and MCP tool-use audit logs, that are likely to be added in late 2026.
For tactical questions (“is this RLS policy correct?”, “should we move to Aurora Serverless?”), the senior architect retainer at £5K to £10K a month, cancellable any month, is the right shape. The full 5-day audit is the right shape when you need a written brief defendable at diligence.
Yes. A good third of our audits are on codebases built in Cursor, Lovable, v0, or Claude Code. We don’t care how the code arrived, we care what it does under load and what an acquirer’s CTO will find. The fix-list comes ranked by severity with an effort estimate against each line, so you can fix the cheap criticals yourself and book us for the senior pairs.
Every audit has two senior engineers paired, not one. Every decision goes into an ADR the same day. Mohit reviews the brief before it ships. Two handovers in seven years, both inside 48 hours.
For paid audits, yes, signed inside 30 minutes via DocuSign before any code access. For the free library itself there’s nothing to NDA, it’s public. UK VAT registered, listed on Companies House, shipping since 2019.
A look at the kind of architecture audit library surface we hand over — real screens, real data, documented and yours from day one.
Tell us where the codebase lives, what the diligence timeline looks like, and which patterns you’ve already self-audited. Mohit replies inside 24 hours: a clear yes, a clear no, or the one question that decides it.
Yes, no, or the deciding question. Straight to your inbox.
Signed inside 30 minutes. Read-only access. The audit starts.
30 pages, a one-page diagram, six ADRs, a ranked fix-list.