Technical diagnosis in 5 days
We review a production system and deliver a short report with the problems ordered by severity, the evidence and the estimated hours to fix them.
Price
USD 3,500–4,500
USD 3,500: one repository, a team of up to 3 developers.
USD 4,500: more than one repository, a team of more than 3 developers or a report for an investor.
Fixed price. 50% upfront when signing and the balance when the report is delivered.
What we review
- Architecture and code structure
- Security against the OWASP Top 10 (targeted review)
- Dependencies with known vulnerabilities
- Deployment and infrastructure configuration
What we do NOT do
- Full penetration test
- More than one repository
- Implementing the fixes
- Formal certification or compliance (ISO 27001, SOC 2)
What you get
- Report with an executive summary on the first page
- Each finding with severity, evidence, recommendation and estimated hours
- A 45-minute walkthrough meeting
What we need from you
- A signed NDA before we receive any access
- Read access to the main repository
- A staging or development environment, read-only
- A technical person for the interview (60 to 90 minutes)
What happens next
After the walkthrough meeting you decide: implement with your team, with us or with another vendor. The diagnosis and the implementation are separate contracts.
Timeline
The timeline is 5 business days from when we receive access. The start date depends on our calendar: we confirm it when you accept the proposal.
Frequently asked questions
How is it different from the full audit?
The diagnosis is a focused review: one repository, one staging environment and a short report in 5 days. The full audit takes 1 to 2 weeks, starts at USD 3,500 and delivers a longer report with a 30/60/90-day roadmap.
Can you review more than one repository?
Not in the standard diagnosis. If your system has several repositories, more than 3 developers or you need the report for an investor, the fixed price is USD 4,500.
What if the system is very large?
We review the most critical parts of the main repository and the report states what was left out. If you need more depth, we propose an audit.
Who sees my code?
Only the people needed to do the work have access: the Madariaga team and, when needed, specialized collaborators under the same confidentiality obligations. Daniel leads the review and the main technical decisions. We sign an NDA before receiving access and work with read access to the repository, never with production access.
Can it be done on a system that is not in production yet?
Yes, as long as there is a repository with code to review. It is common before a launch or a funding round.
Tell us which system you have
Request the diagnosis or book 20 minutes to see if it fits. We reply within 1 business day.