How much does a code audit for an AI-built app cost in the UK?
What a code audit of a Lovable, Bolt, Cursor or Replit app covers, what you should get back, and what We UC charges for ours.
A code audit of an AI-built app from We UC costs £2,500 + VAT, fixed, and the fee is deducted from the first phase if you go ahead with us on the fix. For that you get a written report covering security, data, hosting, code, payments and integrations, a priced plan, and a walkthrough call. Other firms price differently, so the useful test is what the price includes and whether it is fixed before work starts.
What does a code audit of an AI-built app actually cover?
It covers whatever could hurt you once real customers and real money are involved. Ours looks at six areas: security, data, hosting, code, payments and integrations, and running costs. Nobody changes anything during the audit. We read the app and write down what we find.
Two examples show what that means in practice, and both come from the vendors' own documentation.
If your app stores data in Supabase, the database tables need row-level security switched on. Supabase's documentation on row-level security says a table in an exposed schema without it "is readable and writable by any role with a grant on it". An app can look finished and work perfectly for its owner while every customer's rows are open to anyone who knows where to look.
If you take payments through Stripe, your server should check that each webhook message really came from Stripe before it acts on it. Stripe's webhook guide says that without verification, "an attacker could send fake webhook events to your endpoint to trigger actions like fulfilling orders, granting account access, or modifying records." Checking the Stripe-Signature header is the fix, and it is easy to miss when the code was generated to get a payment flow working.
What do you get at the end?
You get a written report and a priced plan, then a walkthrough call where we go through it with you. The report is yours either way, so you can hand it to your own developer or freelancer and never speak to us again.
| Part of the audit | What it answers |
|---|---|
| Security | Who can read or change data they shouldn't be able to reach? |
| Data | Where does customer data live, and could you restore it? |
| Hosting | What runs where, and who holds the keys to it? |
| Code | Can someone new add a feature without breaking two others? |
| Payments and integrations | Are Stripe, Xero, Zoho or other connections handled safely? |
| Running costs | What are you paying for, and what will it cost as you grow? |
What happens after the audit?
There are three outcomes, and the report says which one we think fits. We can fix it, starting with the urgent problems and then the rest in fixed-price phases. We can rebuild the parts that are quicker to rebuild than to patch, and only those. Or you take the plan and use it elsewhere. If the app is in worse shape than you hoped, the report says so and explains why, though in our experience a lot more can usually be kept than people fear.
What access does an auditor need?
Read access to your code and to wherever the app is hosted. That is all we ask for, and nothing is changed during the audit. If you built it yourself, you are usually the person who holds those logins. If a freelancer or consultant built it, it is worth checking who owns the accounts before we start.
How do you compare quotes?
Ask each firm four things in writing: whether the price is fixed, what the report covers, whether the report is yours to keep, and whether the fee counts towards any fix. An hourly estimate for an audit tells you little, because the app's size drives the hours and you can't see the app yet from the outside. A fixed price moves that risk to the firm.
We should say where we sit in this. We UC is a UK software company, and the team that audits your app is the team that keeps our own products running in production: Olatti, a UK business phone network, and Quenta, an app that posts receipts into Xero. We use AI heavily for speed, and an engineer reviews every change before it ships.
Common questions
Will you judge us for building it with AI?
No. You got further than most people ever do, and AI tools are good at getting something working. The audit is for the part that comes next, making it safe and ready for real customers.
Is the audit fee separate from the fix?
If you go ahead with us on the fix, the audit fee is deducted from the first phase.
Do you publish prices for building or running software?
Not yet. Build is scoped first and priced in fixed phases, and Run is a monthly retainer, so for both you ask us for a quote.
If your app is already taking money or holding customer data, you can book a Rescue audit, or tell us what you've built and we'll say whether an audit is the right first step.