What’s a “deep audit” beyond this checklist?
A deep audit is the 1-3 day paid engagement where I clone your repo and look at the things 50 yes/no questions can’t. The full deep-audit checklist runs to ~140 questions plus several diagnostics. Specifically:
- Custom-module security review (~25 checks): SQL injection, CSRF, XSS, IDOR, hard-coded credentials, deprecated crypto, PHP 8.3 compatibility, vendor-specific anti-patterns.
- Slow-query log analysis: 7 days of slow-log data parsed, top-10 worst queries diagnosed, indexer staleness mapped to specific table-scan queries.
- B2B data integrity audit: companies, quotes, segment pricing, requisition lists, check for orphan records, broken FKs, stale customer-group sync.
- ERP handshake validation: diff inventory + price + customer between Magento and ERP, identify drift, document the canonical source per field.
- Performance deep-dive: Lighthouse on top-20 URLs, INP audit, LCP per template, cache-warm coverage report, CDN hit-rate analysis.
- Composer + extension audit: every dependency’s actual maintenance status, abandoned-package detection, security-advisory match-up.
- Custom code documentation: a written map of every
app/code/Vendor/Moduledirectory with risk + criticality + handoff notes.
Output: a 20-40 page written report with prioritized fix list, fixed-price scope per item, and a recommended 30/60/90-day execution plan. Roughly $1.5k, $3k for the audit, plus separate fixed-price quotes for the actual remediation work.