Five questions
- Is it exposed? Permissions, production settings, dependencies
- Is it current? Django and Python versions, dependency currency
- Is it tested? Not coverage, but whether the important parts are covered
- Is it maintainable? Could another developer work on it
- What does a typical change cost?
The last question is the commercially important one. An application where a simple change takes three days is expensive regardless of how it scores on anything else.
Security specifically
- Record-level permissions on every view, list and export
- Production settings — debug, hosts, cookies, HTTPS
- Where media files are stored and how they are served
- Raw SQL, marked-safe output and CSRF exemptions
- Dependencies with known vulnerabilities
Practical signals
| Signal | Indicates |
|---|---|
| Runs locally in a day | Setup documented |
| Deployments repeatable | A process exists |
| Tests pass | They are maintained |
| Migrations consistent | Environments in step |
| Settings from the environment | Environments separable |
What an audit should produce
A prioritised list: urgent, important, cosmetic, with an effort estimate against each. Written so a non-technical owner can decide what to fund.
Not a list of style deviations, which is what many audits produce and which nobody can act on.
When to commission one
- Before acquiring a business that depends on it
- When taking over from another supplier
- When changes take longer than they used to
- Before deciding between fixing and rebuilding
- After any security incident