Services

AI & Vibe Coding Forensic: AI and Agentic Code Audit

The independent technical audit examines AI-generated, agent-developed and spec-driven codebases using the existing code and available development evidence. Before work starts, the audit question, included repositories, agent workflows and evidence are agreed. The result distinguishes substantiated findings, risks, hypotheses and open questions.

Technical responsibility: Oliver Fries

I am Oliver Fries from Lemgo in OWL, a freelance software engineer, architect and tech lead with more than 14 years of .NET experience. The audit is for CTOs, heads of engineering and IT leaders who need to assess AI-assisted software using the code and the development evidence that is actually available.

When is this service a good fit?

AI agents or spec-driven development already produce production-adjacent code, but the technical evidence chain is incomplete or difficult to assess.
You need to decide whether tests, reviews, permissions and quality gates are sufficient to expand AI-assisted development.
Architecture drift, inconsistent patterns, package risks or security signals need to be classified using available evidence.
You need an independent basis for technical priorities before approving more agent workflows or releases.

What I examine using the available evidence

Before work starts, the specific audit question, included code areas and available evidence are recorded in writing. The audit examines only the areas from the following list that are relevant to that question. A complete review of every area is included only when expressly agreed. Missing sources are recorded as evidence gaps or open questions rather than replaced with assumptions.

Specification and implementation: consistency between requirements, acceptance criteria, prompt and specification changes, code and observable behavior.
Agent artifacts, logs and other development evidence: where available, they show which tasks, tools, rules and verification steps were actually used in the agent workflow.
Git history and pull requests: change size, review and approval traces, frequently changed areas and the traceability of individual decisions.
Architecture and architecture drift: system boundaries, coupling, and duplicated or inconsistent implementation patterns.
Tests and the verification funnel: which requirements, risks and failure paths the tests cover, and how specification, implementation, verification and release connect.
Integration, build, CI/CD and release process: existing quality gates, manual handoffs, reproducible checks and gaps between a code change and delivery.
AI code reviews and human reviews: which classes of defect the current controls can detect, and where context, review depth or sample size limits their value.
Dependencies and packages: known vulnerabilities, versions, provenance and update risks based on the available package and scanner information.
Security boundaries, permissions and secrets: access boundaries, tool permissions and visible signs of secret or credential exposure.
Risks in agent-produced code and generated-code hotspots: suspicious areas are attributed to an agent workflow only when logs, pull requests or agent artifacts support that connection.

Process

Define the audit question and package: for Standard, we delimit one repository and one specification or agent workflow. For Enterprise, we name the included repositories and related multi-agent workflows. We also clarify whether an additional Code & Architecture Forensic is needed.
Map the evidence chain: I classify available specifications, prompts, agent artifacts, logs, pull requests, Git history, tests, build data and release data, and document missing connections.
Examine code and controls: within the agreed scope, I assess architecture, hotspots, dependencies, security boundaries, tests, reviews, integration and delivery. Every item is marked as an evidence-backed finding, risk, hypothesis or open question.
Prepare decisions: Standard takes 2–3 days and Enterprise takes 4–5 days. The period begins once the agreed access and data are available. In the review, I explain evidence strength, limitations, priorities and the next verifiable steps.

What you provide

Access to the agreed repositories with their Git history and available pull requests.
Available specifications, prompts, acceptance criteria, agent artifacts and logs. Missing material does not automatically exclude the audit, but it limits the conclusions that can be supported.
Available information on tests, integration, build, CI/CD, the release process, dependencies and scanners in use.
Existing rules for permissions, tool access, secrets, approvals and failure cases in the agent workflows.
People who can explain the system context, working method, review process and the technical decision ahead.

Result

A written assessment of the agreed audit question with a traceable evidence chain from specification and agent workflow through implementation and tests to build and release, including visible gaps.
Prioritized evidence-backed findings, risks, hypotheses and open questions, with the strength of evidence stated for each.
A technical assessment of code quality, architecture drift, test effectiveness, review limits, dependencies and security signals within the agreed scope.
Concrete next verification steps and options for acceptance criteria, tests, agent boundaries, reviews and quality gates.
A basis for deciding whether the focused audit is sufficient or a separate Code & Architecture Forensic or another specialist assessment is appropriate.

Timeline and price

Standard: 2–3 days · Enterprise: 4–5 days

€3,500–€7,000 fixed price, net plus VAT

Packages

Standard: 1 repository · 1 bounded specification or agent workflow · 2–3 days €3,500 fixed price, net plus VAT
Enterprise: Repositories named in advance · related multi-agent workflows · 4–5 days €7,000 fixed price, net plus VAT

Agreed scope and documented acceptance.

Scope limits and exclusions

The use of AI proves neither good nor poor code quality. The code, its behavior and the available technical evidence determine the assessment.
Agent contributions cannot be attributed reliably from source code or Git history alone. Provenance statements rely exclusively on available logs, pull requests and agent artifacts.
Missing specifications or development evidence are recorded as evidence gaps. They prove neither a defect nor a controlled process.
The Vibe Coding Assessment focuses on the quality and security gaps of the agents and their working method. It does not constitute a complete code-forensic examination of the entire system.
The Vibe Coding Assessment and Code & Architecture Forensic can share individual audit areas. The complete Code & Architecture Forensic must be commissioned separately or in addition.
Examining visible security boundaries, permissions and exposure signals does not replace a separately commissioned penetration test or complete security audit.
The time-boxed and scoped audit cannot identify every defect or risk across the entire codebase. Its results apply to the agreed scope and the evidence available.
The fixed prices apply to the repositories, workflows and audit questions agreed in advance. Additional repositories, further workflows or a later extension of the assignment are agreed separately.

Frequently asked questions

Is the Release Risk-Check required first?

No. The free Release Risk-Check is a questionnaire, not a technical review or initial diagnosis. The AI and agentic code audit can be requested directly.

How does the audit differ from a classic legacy audit?

The AI and agentic code audit pays particular attention to specifications, agent workflows, provenance and controls for AI-assisted development. Code & Architecture Forensic examines an established system more broadly. Architecture, Git, tests, build and release can be relevant to both assignments.

Is the Vibe Coding Assessment a complete code-forensic review?

No. It focuses on the quality and security gaps of the agents and their working method. A complete examination of the codebase is commissioned as Code & Architecture Forensic separately or in addition.

What happens when specifications or agent logs are missing?

I examine the other available evidence and state which connections cannot be supported. The gap is documented as a limitation or open question rather than filled retrospectively with an assumption.

Can the audit tell which code came from an agent?

Not reliably from source code and Git history alone. Attribution is supportable only where available logs, pull requests or agent artifacts document it.

Is AI-generated code automatically riskier?

AI use proves neither good nor poor code quality. The audit assesses the concrete implementation, its evidence and the controls that are effective within the agreed scope.

Can the Special Audit be requested directly?

Yes. In the introductory call, we clarify the decision ahead, the available evidence and the appropriate scope. A prior Release Risk-Check is not required.

How do Standard and Enterprise differ?

Standard examines one repository and one clearly bounded specification or agent workflow in 2–3 days. Enterprise examines the repositories named in advance and related multi-agent workflows in 4–5 days. Both packages include the written assessment and review for the agreed assignment.

What happens next

In the introductory call, we clarify the decision the audit should support, the available evidence and the repositories or agent workflows involved. This determines which assignment fits the existing packages and which conclusions the evidence can support.

Book an introductory call about the AI and agentic code audit →