Ruby on Rails code audit
Most of the apps we audit are Rails apps, often inherited, rushed to launch, or partly written by AI. We review yours against the problems Rails apps actually have, and tell you in plain English which ones matter and what to fix first.
Every Rails audit covers the eight areas in every code audit, plus checks written for Rails itself.
Record lookups that aren’t scoped to the signed-in user, admin areas and mounted engines (Sidekiq, Active Admin) without authorization, and tenant data that leaks between accounts.
Devise or hand-rolled authentication, brute-force protection, cookies and CSRF, and credentials, secret_key_base, or API keys committed to the repo.
Mass assignment through strong parameters, SQL built from strings in Active Record, html_safe and raw in views, open redirects, and file uploads through Active Storage.
Validations with no database constraint behind them, callbacks with side effects, race conditions, risky migrations, and background jobs that charge a card twice when they retry.
N+1 queries, unbounded queries and missing pagination, caching, slow work in the request, and Puma, Sidekiq, and connection pool settings that don’t fit together.
Whether your Rails and Ruby versions still get security fixes, the gap between your Rails version and its framework defaults, and the gems that will block the next upgrade.
Every audit runs Brakeman, bundler-audit, and RuboCop Rails against your code, but scanners only find the patterns they know. The findings that hurt most in Rails apps are usually ones a scanner can’t see:
find that should have been current_user.projects.findThose come from reading the code, and from having fixed the same problems in our own Rails apps for almost twenty years.
Three levels, each a fixed fee. Essentials covers the most important Rails checks; Standard and Comprehensive cover all of them. See everything every audit includes.
A fast health check
$1,000 fixed fee
Best for: Answering "is this codebase OK?" before you buy, hire, or launch.
A thorough review
$1,500 fixed fee
Best for: An inherited codebase, a pre-launch review, or before hiring a team.
Everything in Essentials, plus:
Due diligence depth
$2,500 fixed fee
Best for: Acquisitions and technical due diligence, compliance preparation, or after an incident.
Everything in Standard, plus:
Rails supports each release with security fixes for about two years, so many apps are running an end-of-life version that no longer gets them. Every Rails audit checks your Rails and Ruby versions against the official maintenance policy.
If you’re behind, the report lays out the upgrade one version at a time, and Standard and Comprehensive also list the gems and deprecations that stand in the way. When you’re ready, we can do the upgrade too.
Checked November 13, 2026 against the Rails maintenance policy.
We audited this firm's job and invoicing app, fixed the three urgent issues we found, rebuilt its invoice engine, upgraded Rails, and still look after it.
A swim instruction video site we took over after launch and developed for six years: subscriptions, payments, and video delivery.
Dental practices use it to hire staff and book temps online. Along the way we built its Stripe subscriptions, the API behind its mobile app, and AI-based matching, as it grew from one local market to nationwide.
The same fixed fees as every audit: $1,000 for Essentials, $1,500 for Standard, and $2,500 for Comprehensive. Compare the levels. Hire us for hourly development within 30 days of your report and up to $1,000 of the fee comes off your first invoice.
Yes. Every Rails code audit includes a security audit: data access, admin areas, sign-in, sessions, secrets, injection, and file uploads, checked against the known weaknesses of Rails, plus Brakeman and bundler-audit scans.
Any of them, from apps that have been running on an old version for a decade to apps on the latest release. If you’re behind, the report says how far and lays out the upgrade one version at a time; Standard and Comprehensive also list the gems that stand in the way.
Yes. API-only Rails apps get the same review, with extra attention to authentication tokens, CORS, and what each endpoint returns. If the front end is part of the audit, it gets its own checks for React, Next.js, or React Native.
Essentials reviews the code without running it. Standard and Comprehensive boot your app and run your tests in an isolated, disposable environment. Either way, we never connect to your production servers, databases, or accounts.
Yes. We’ve been maintaining and upgrading Rails apps since 2007. We can work alongside your team or take it on ourselves, and the audit credit applies.
Tell us about your Rails app and we'll recommend the level that fits.