Mobile App Codebase Audit
An audit is not an extended code review. Code review looks at a specific PR. Codebase audit answers: "Can we live with this code for the next 2–3 years, add features without constant regressions, onboard new developers in reasonable time?" This is analysis of systemic technical debt, not spot bugs.
What's Included in an Audit
Architectural connectivity. Look at dependency graph: are there circular dependencies between modules, are layer boundaries violated, does UI depend on specific network libraries directly. For iOS — check division into feature modules or at least MVVM/VIPER adherence within one target. For Android — Clean Architecture with Use Cases, or everything dumped in Activity. Tools: Xcode Dependency Graph, Android Studio Module Dependencies, ArchUnit for automated checks.
Test coverage. Look not just at percentage but what exactly is covered. 80% coverage on trivial getters and 10% on business logic — worse than 30% proper tests on Use Cases and ViewModels. Check integration tests (UI, XCUITest, Espresso), mocks for network dependencies, edge case tests (empty list, network error, timeout).
Dependency management. CocoaPods vs SPM, Gradle catalogs, outdated versions. Libraries with known CVE — check via OWASP Dependency-Check or snapshot from pod outdated / ./gradlew dependencyUpdates. Especially watch libraries requesting excessive permissions (Analytics SDK, Ad SDK) — they may violate App Store/Play Store privacy policies.
Performance and memory leaks. Static analysis doesn't replace profiler but shows patterns: synchronous tasks on main thread, image created without caching in loop, URLSession created per-request instead of singleton. For Flutter — const constructors not used where should, expensive computations in build().
Security. Automated analysis via MobSF (Mobile Security Framework) or Semgrep with mobile rules. Look for: hardcoded API keys in code or plist, logging sensitive data, unsafe IPC (exported Activities without permission), use of outdated algorithms (MD5, SHA1 for critical operations).
Tools
| Task | iOS | Android |
|---|---|---|
| Static analysis | SwiftLint, Periphery (unused code) | Detekt, Android Lint |
| Dependencies/CVE | pod audit + OWASP DC |
OWASP Dependency-Check |
| Code complexity | SonarQube | SonarQube |
| Security | MobSF | MobSF |
| Memory leaks | Instruments (Leaks) | LeakCanary |
SonarQube integrates in CI and counts cyclomatic complexity, code duplication, cognitive complexity. Function with complexity > 15 — candidate for refactoring, this isn't taste, it's measurable risk.
Periphery for iOS — finds unused functions, classes, protocols. Large codebase accumulates thousands of dead code lines read, maintained, and feared to delete.
Audit Result Format
Report with four levels: Critical (immediate fix — data leak, crasher), High (next sprint — architectural risk, security issue), Medium (technical debt, planned), Low (quality recommendations).
Additionally — roadmap: what to refactor first, what can be deferred, which changes carry highest regression risk. Audit without action plan — meaningless document.
Timeline — 3–5 days on medium-sized project. Large projects (300k+ lines, multiple targets/modules) — up to 2 weeks.