What static analysis tools do you use?

PHPStan and Psalm primarily. We start at level 8 and report how many violations exist at each level down to the level your code currently passes. The number gives you a quantitative bar to improve against.

Do you write tests as part of the audit?

No. The audit measures coverage and identifies gaps. Writing tests is a separate engagement. Knowing where coverage is missing is more valuable than partial new coverage.

What is the tech-debt score?

A composite of cyclomatic complexity, dependency depth, test coverage and rule violations. Each module gets a score; the report orders them by debt-to-business-value so you fix the worst-payoff modules first.

Can you handle a large monorepo?

Yes, with a longer fixed quote. We run the static analysis incrementally and present the report module by module. Architectural review at the inter-module boundary is included.

Do you cover frontend code?

Yes for theme code, JavaScript and TypeScript. Static analysis tools differ (ESLint and tsc instead of PHPStan) but the methodology and output format are the same.

Website Audits

Code Quality Audit

Code quality audit on your Magento or ecommerce codebase. Static analysis, custom-module review, test coverage, technical debt scoring.

Turnaround: 5 to 10 days
Tools: PHPStan + Psalm
Output: Tech-debt roadmap
Walkthrough: 60 minutes

Overview

What it is.

Independent code quality audit on Magento and ecommerce codebases. Static analysis (PHPStan, Psalm), custom-module review against framework patterns, automated test coverage analysis, and a technical debt score that tells you where the maintenance burden is hiding. Output is a remediation roadmap your team can work through. Most audits run 5 to 10 working days depending on repository size. Multi-repo or microservice architectures get a longer fixed quote.

What you get

Deliverables.

Static analysis run at the strictest level your code passes
Custom-module review against Magento framework patterns
Test coverage analysis with priority recommendations
Technical debt score per module with effort estimates
Dependency hygiene report (versions, vulnerabilities, abandoned packages)
Code style and PSR compliance check
Prioritised remediation roadmap
60-minute walkthrough call

Honest limits

What it isn't.

How it works

From inquiry to handover.

01
1. Brief
Repository access. Audit scope confirmed (full codebase vs specific modules).
02
2. Audit
Static analysis run. Module-by-module review. Findings catalogued.
03
3. Report + walkthrough
Roadmap delivered. 60-minute call with the engineer who ran the audit.

Frequently asked

Questions we get from people about to book.

What static analysis tools do you use?: PHPStan and Psalm primarily. We start at level 8 and report how many violations exist at each level down to the level your code currently passes. The number gives you a quantitative bar to improve against.
Do you write tests as part of the audit?: No. The audit measures coverage and identifies gaps. Writing tests is a separate engagement. Knowing where coverage is missing is more valuable than partial new coverage.
What is the tech-debt score?: A composite of cyclomatic complexity, dependency depth, test coverage and rule violations. Each module gets a score; the report orders them by debt-to-business-value so you fix the worst-payoff modules first.
Can you handle a large monorepo?: Yes, with a longer fixed quote. We run the static analysis incrementally and present the report module by module. Architectural review at the inter-module boundary is included.

Ready to start?

Tell us about your project.

A member of our team reads every message. Replies within one business day. No sales call required.

See all services