Before the first release
You have a working prototype, TestFlight, internal build, or codebase and need to separate blockers from work that can wait. AI-assisted or low-code software qualifies when the code or product can be audited technically.
Existing mobile app audit
Find the risks and define a remediation plan for an existing mobile app.
Do you have a prototype, TestFlight build, or codebase before launch, or a product already used by customers? We review React Native or Expo for crashes, stability, technical security risks, performance, maintainability, and critical flows. You receive evidence, priorities, and an ordered plan.
Scope my app auditWe first confirm the product stage, available access, and the decision the audit must support. The qualification call is not a technical audit.
01
Mobile app
02
API and data
03
Build and stores
04
Monitoring
05
Release / repair / modernize
The right moment
One audit. Two decision paths.
This audit is for a company with an existing app or codebase and a concrete decision to make. It is not an offer to build a product from scratch.
When the app is already live
The product has crashes or problems with stability, technical security, performance, maintainability, or critical flows. You need a repair scope or modernisation plan.
One decision pack for both paths
- evidence
- risk register
- priorities
- release / repair / modernize decision
- ordered remediation plan
Technical risk
A working screen does not show whether the product is safe to maintain.
Before the first release and after a product goes live, the whole system needs review: code, data, failure paths, release configuration, monitoring, performance, and ownership of accounts and infrastructure.
- 01
The happy path works, but API failure, lost connectivity, or an expired session remains unclear.
- 02
A build works on one machine, while signing and publishing are not reproducible.
- 03
Crashes, performance drops, or critical-flow failures return without a clear cause or owner.
- 04
The repository, store accounts, secrets, and monitoring do not have a clear owner.
Review scope
We assess the system, not who wrote the code.
The default scope covers React Native and Expo. Backend systems and other stacks require a separately confirmed scope.
Code and architecture
Module boundaries, dependencies, duplicated logic, maintainability, and upgrade path.
Data, APIs, and security surface
Sessions, permissions, secrets, validation, timeouts, retries, offline behaviour, and visible configuration risks.
Testing, performance, and resilience
Critical-flow coverage, crashes, device behaviour, network conditions, and failure scenarios.
Build, release, and ownership
CI/CD, signing, store accounts, configuration, monitoring, documentation, and responsibility.
Decision pack
Know whether to release, repair, or modernize.
Every material finding is connected to evidence, business impact, and a recommended next step.
- a release / repair / modernize decision with explicit caveats;
- a prioritised risk register with evidence;
- release blockers, urgent repairs, and improvements separated;
- a release or stabilisation checklist tailored to the app;
- an ordered remediation plan;
- a technical walkthrough of the findings.
How it works
From qualification to a decision.
Qualification
We confirm the product, technology, stage, available access, and the decision the audit must support.
Definition of Ready
We agree the scope, commit, builds, environments, and access to evidence.
Baseline and review
We reproduce the agreed build and review critical flows and technical areas.
Triage and plan
Each finding receives evidence, impact, priority, recommendation, and a recheck condition.
Decision and readout
We deliver the readiness status, risk register, action plan, and discuss it with the team.
A clear scope also requires clear exclusions.
The standard audit is not a penetration test, formal UX/CRO audit, formal WCAG conformance audit, or certification. It is not a legal opinion or a guarantee of App Store or Google Play acceptance. Remediation, retesting, and implementation are separate scopes.
Looking to improve activation, conversion, or retention? See our mobile growth audit
Paid technical audit
Confirm fit and define the scope.
This form is for a company with an existing app or codebase, before launch or already in production. We first confirm scope and available access.
Questions before you apply.
Can you review an app built partly with AI?
Yes. We do not judge code by its origin. We assess system behaviour, maintainability, the release path, and evidence within the agreed scope.
Do you audit React Native and Expo apps?
Yes. They are the default V1 scope. Another stack requires separate confirmation of capability and scope.
Is this a penetration test?
No. We can perform a bounded review of the security-risk surface, but it is not a pentest, certification, or legal opinion.
Do you fix the issues you find?
The audit ends with an action plan. Remediation or retesting can be delivered by the current team, another partner, or GMI under a separate scope.
What access do you need?
We agree the scope before starting. Code, a reproducible build, and environment information are usually required. Backend, store, and monitoring access depends on the audit goal.
Can you check App Store and Google Play readiness?
We can review agreed parts of the release path, but we cannot guarantee platform approval or a defect-free production release.
Need a different next step?
Make the decision from evidence, not another assumption.
Show us the product stage and the problem to solve. We will tell you whether a technical audit is the right next step.