Forjar o Engenho
From exposed code to a fixed system, without stopping the business A phased path to assess the real state of your code and fix what's missing — from diagnosis to implementation, without the risk of a big-bang.
Most startups audit their code too late.
They build fast, with freelancers, interns or vibe-coding, and never stop for a second senior opinion. The code works — until an investor, a buyer, or an incident actually tests it.
The result is always the same: hidden technical debt, decisions made blind, and the feeling that “it's probably fine”. It isn't. And you only find out by looking.
What doesn't get audited eventually exposes itself.
How it works
- 01
The Problem
Thirty minutes — free, no commitment. We find out exactly what risk is keeping you up at night: scale, funding, or a scare you've already had.
- 02
The Map
We assess your code and architecture — severity-ranked findings, with live proof — before touching a single line.
- 03
The Agreement
We present exactly what will be fixed or built, in how long and at what cost. No surprises. No fine print.
- 04
The Forge
Four to eight weeks — we fix what's broken or build what's missing, with a quick win in the first few weeks. Always with access to the project status.
- 05
The Proof
Demo with your team before going into production. We adjust what's needed — while there's still time.
- 06
Live
You receive the working application, the closed correction report, and support for your team to carry on alone from the day of delivery.
What's included
Complete architecture and code diagnosis
Severity-ranked, phased correction roadmap
Fixing what's broken or building what's missing
Controlled demonstration of real vulnerabilities
Ongoing support and maintenance
This path isn't for everyone — and that's a good thing.
It works best when there's already a real product in production.
It's for you if…
- You have a product in production, not just a proof of concept
- Your code has never been reviewed by someone senior outside the team
- An investment, sale, or fast growth is approaching
- You feel like “something might be wrong” but can't quantify the risk
It's not for you if…
- It's still just an idea, with no real users
- You're looking for a generic cybersecurity certification, not an engineering assessment
- You just want to “try it” without committing to fix anything
- You expect results without giving access to the code
If you don't fit, we'll say so. There's no time for the wrong projects.
Frequently asked questions
It depends on the state of your code and on what needs fixing or building. The architecture/code audit is the entry point and implementation is phased — you only move to the next phase when you are satisfied. In the free 30-minute diagnosis you get a clear idea of the investment before any commitment.
We work in phases. The first deliverables arrive in weeks, not months — and you only move to the next phase when you're satisfied.
No. We roll out in a phased, reversible way, integrating with what you already use, without interrupting the day-to-day.
It's not about trust, it's about having a second senior set of eyes — the best teams always get external code review. The audit doesn't replace your developer, it gives you the certainty that's missing.
We stay on with ongoing maintenance and support, and we evolve the system as the business grows. No lock-in — you stay with us as long as it makes sense.
Yes. We work remotely with companies in Portugal and beyond.
Yes — it is a large part of our work. AI-generated apps reach production fast, but they often ship exposed keys, misconfigured permissions and untested logic. We start with an audit to see what is at risk, then fix it in phases, without rewriting from scratch when it isn't needed.
Almost never. The goal is to stabilise what you have: critical issues first, the rest in phases. We only recommend rebuilding parts when maintaining them costs more than rebuilding — and we tell you that in the diagnosis.
From exposed code to a fixed system, without stopping the business
A phased path to assess the real state of your code and fix what's missing — from diagnosis to implementation, without the risk of a big-bang.