Audit Checklist
This page outlines the specific areas examined during a Platform AI Cloud audit. It is not exhaustive — every codebase has unique characteristics that shape where the review focuses — but it gives a clear picture of what the two-week review covers by default.
Review Process
How the Checklist Is Used
The checklist functions as a starting framework, not a rigid script. The reviewer uses it to ensure that no domain is overlooked, but the depth of investigation in each area is adjusted based on what the codebase reveals. An app with complex authentication flows will receive deeper security scrutiny in that area. An app with heavy data processing will have more focus on memory and CPU patterns.
All items on the checklist are reviewed for every audit. Items that do not apply to a specific codebase (for example, background processing items for an app with no background tasks) are noted as not applicable with a brief explanation.
Performance
How the app behaves under real-world conditions across different device capabilities
Rendering and UI
- Main thread blocking operations identified
- List and scroll view rendering efficiency
- Image loading and caching patterns
- Animation frame rate considerations
- Layout pass complexity in view hierarchies
Memory Management
- Retain cycle and memory leak patterns
- Large object allocation in critical paths
- Cache sizing and eviction strategy
- Background task memory footprint
Network and I/O
- Request batching and redundancy
- Response caching implementation
- Offline handling and degraded network behavior
- Database query efficiency and indexing
- File I/O on main thread
Startup and Lifecycle
- Cold start time and initialization sequence
- Background/foreground transition handling
- Battery impact of background operations
Security
How the app handles sensitive data, authentication, and communication
Data Storage
- Sensitive values in local storage or SharedPreferences
- Keychain and Keystore usage patterns
- Database encryption at rest
- Log output containing sensitive information
- Temporary file handling and cleanup
Network Security
- Certificate pinning implementation
- TLS configuration and minimum version
- API key and secret handling in the binary
- HTTP vs HTTPS usage across all endpoints
Authentication and Authorization
- Token storage and refresh logic
- Session expiry and invalidation
- Biometric authentication implementation
- Deep link handling and parameter validation
- Inter-app communication security
Binary and Runtime
- Hardcoded credentials or secrets in source
- Debug flags left active in release builds
- Obfuscation and code protection review
Architecture
How the codebase is structured and how well it supports ongoing development
Code Organization
- Module and layer separation clarity
- Dependency direction and coupling
- Consistency of patterns across the codebase
- Separation of business logic from UI code
State Management
- State ownership and flow clarity
- Shared mutable state risk areas
- Reactivity and update propagation patterns
- Persistence of state across sessions
Scalability Signals
- Areas where adding features would require significant refactoring
- God objects and oversized classes
- Configuration and environment management
- Error handling consistency
- Logging and observability setup
Dependencies
Third-party libraries, SDKs, and their associated risks
Version and Vulnerability
- Known CVEs in pinned dependency versions
- Significantly outdated packages
- Abandoned or unmaintained libraries
Permission and Data
- SDK permission requirements vs. stated purpose
- Third-party data collection behavior
- Analytics and crash reporting data scope
- Licensing compatibility review
Ready to Have Your App Reviewed?
Send us your project details and we will follow up to discuss whether the audit scope is a good fit for your codebase and timeline.