The January Technical Audit: What We Review With Every Client

Every January, we run the same technical audit across all our retainer clients. Not to find billable work – to catch problems while they’re still boring $500 fixes, not urgent $5,000 emergencies.

Here’s what we check and why it matters.

Security & Dependencies

We check Rails security patches and CVE databases for your specific version. We run bundle audit and npm audit to catch vulnerable dependencies, verify SSL certificates aren’t expiring in the next 90 days and audit who has admin access to your application and hosting – former employees still in the system is more common than you’d think.

Think of this as checking your smoke alarms. Incredibly boring until the one day it’s not.

The most common issue we find? Gems or packages with known vulnerabilities that have patches available. The fix takes 20 minutes. The cost of ignoring it until someone exploits it? That’s the five-figure conversation nobody wants to have.

Performance Degradation

We analyse database queries for N+1 problems and missing indexes, check what’s in your background job queue and what’s been failing silently, look at server resource trends over the past year; memory usage, disk space, the stuff that creeps up gradually until suddenly you’re down.

Applications slow down over time like car engines. Code that worked fine with 1,000 products struggles with 10,000. Queries that were fast enough in 2022 aren’t anymore.

Real example: A client’s server memory usage had climbed from 40% to 85% over six months. A background job was leaking memory – running fine individually but never releasing resources. Left unchecked, they were weeks from crashes.

Infrastructure & Hosting

When did you last test restoring from backup? If the answer isn’t “within the past 90 days,” you don’t actually know if your backups work. We verify backup retention policies, check server OS patch levels, and confirm your CDN is actually caching (not just costing you money while hitting your origin server anyway).

We also look at what happens if your hosting provider has an outage. Do you have a disaster recovery plan or are you just hoping Heroku stays up?

This is the category of things that work perfectly fine until the exact moment you desperately need them. Then you find out your backup restoration process requires a server configuration that doesn’t exist anymore, or your SSL renewal process broke when you switched hosting providers.

Third-Party Dependencies

Payment gateways update their APIs. Shipping providers deprecate endpoints. That Shopify app you installed in 2021 might be abandoned by its developer. We audit all your external service integrations for deprecated versions, security notices, and whether you’re actually still using them.

One client was paying subscriptions for apps handling relatively simple functions – custom product fields, basic inventory alerts, size chart displays. We consolidated some into a single app and wrote custom code for the simpler functions. Saved them $220 per month in recurring subscriptions.

We also check API rate limits and quota usage. Better to know you’re approaching limits during a routine audit than to discover it when checkout stops working during your biggest sale of the year.

Business Continuity

Who has admin access to your application? To your hosting? To your domain registrar? We audit access control across every system because former employees, contractors, agency partners, that developer who did a one-off fix two years ago still having credentials is a security incident waiting to happen.

We document single points of failure. If your only developer who knows the deployment process wins the lottery, can you still ship code? If your Shopify app developer disappears, can someone else maintain it? We map out vendor dependencies and recovery procedures.

This is why we maintain admin-level access to all client systems and document everything. We can’t be your single point of failure either.

What Happens Next

Most issues we find don’t need immediate fixes. They need scheduled attention. A security patch should be applied within days. A performance optimisation can wait until next month. A backup procedure improvement can be planned for next quarter.

The January audit catches problems when they’re $500 fixes, not $5,000 emergencies. This is why retainers work better than hourly billing – we can absorb the small maintenance tasks, plan for the medium stuff, and budget properly for the larger work.

You can pay hourly to fix these issues reactively when they break. Or you can pay a retainer to catch them proactively before they become urgent. One approach costs more and hurts more.

If your Rails application is five years or older, or your Shopify store hasn’t had a proper technical review since launch, we should talk. We offer a starter audit – not the full deep dive, but enough to identify what’s urgent versus what can be deferred. That’s what month one of a retainer relationship looks like: understanding what we’re actually working with before we talk about pricing.

Book a time to discuss what an audit would cover for your specific setup.