Python & Django
Assessing an Application You Did Not Build
Last updated:
Five questions
- Is it exposed? Permissions, production settings, dependencies
- Is it current? Django and Python versions, dependency currency
- Is it tested? Not coverage, but whether the important parts are covered
- Is it maintainable? Could another developer work on it
- What does a typical change cost?
The last question is the commercially important one. An application where a simple change takes three days is expensive regardless of how it scores on anything else.
Security specifically
- Record-level permissions on every view, list and export
- Production settings — debug, hosts, cookies, HTTPS
- Where media files are stored and how they are served
- Raw SQL, marked-safe output and CSRF exemptions
- Dependencies with known vulnerabilities
Practical signals
| Signal | Indicates |
|---|---|
| Runs locally in a day | Setup documented |
| Deployments repeatable | A process exists |
| Tests pass | They are maintained |
| Migrations consistent | Environments in step |
| Settings from the environment | Environments separable |
What an audit should produce
A prioritised list: urgent, important, cosmetic, with an effort estimate against each. Written so a non-technical owner can decide what to fund.
Not a list of style deviations, which is what many audits produce and which nobody can act on.
When to commission one
- Before acquiring a business that depends on it
- When taking over from another supplier
- When changes take longer than they used to
- Before deciding between fixing and rebuilding
- After any security incident
Frequently asked questions
How long does an audit take?
Two to five days for a typical business application, depending on size and documentation.
What does it cost?
Usually a few thousand pounds. Against a rebuild decision or an acquisition, it is inexpensive certainty.
Will it find everything?
It will find the significant things. An audit is proportionate, not exhaustive.
Can you audit code you did not write?
That is what an audit is. We do it regularly and give a straight assessment either way.
Inheriting or acquiring a system?
An audit is a few days against a decision you will live with for years. Happy to run one.
Related services
What we build for problems like this one