CI/CD audit

In two weeks we review your pipelines and the whole path from commit to production. We find what slows you down, what is fragile and where the security gaps are.

CZK 85,000

2 weeks, up to 15 repositories and 1 CI platform. Excl. VAT.

Book a consultation

What we offer

You get a list of findings ranked by impact. Each finding has a concrete recommendation and an effort estimate, so you can move it straight into your backlog. We change nothing in your pipelines.

We do not write applications. We work only on infrastructure, cloud and DevOps.

When it makes sense

Releases take long or fail often and you do not know exactly why.
Every team has built its pipeline differently.
You are preparing for an audit or NIS2 and do not know where you stand on supply chain security.
Before investing in a CI/CD rebuild you want to know where to start.

What you get

An independent view of your CI/CD.
A list of findings with priorities, recommendations and effort.
Quick wins that pay off within days.
Basic delivery metrics (deployment frequency, lead time from commit to production, change failure rate), if the data is available.
A description of the target state you want to reach.

What exactly we do

We assess your pipelines in eight areas:

Architecture and reuse: Templates, duplication, consistency across teams.
Build and reproducibility: Tool versions, caching, build time, deterministic results.
Tests and quality gates: What runs, when, and what stops a build.
Artifacts and versioning: Registry, tags, immutable artifacts, traceability of the version in production.
Deployment and environments: Deployment strategy, approvals, rollback to the previous version, differences between environments.
Secrets and access: Static keys versus OIDC federation, permissions of runners and pipelines.
Supply chain security: Scanning, SBOM, signing, branch protection, dependency checks.
Speed and reliability: Delivery metrics, flaky tests, runner queues.

Who works on it

Three people work on the audit. It is led by a senior.

Senior, project lead
2.5 days

Responsible for
Runs the interviews, reviews findings, sets priorities and recommendations, presents the results.

What you get from them
Main contact, priorities, readout
Middle
2.5 days

Responsible for
Pipeline analysis against our checklist, verification of findings, effort estimates.

What you get from them
Verified findings, estimates
Junior
3 days

Responsible for
Inventory of repositories and pipelines, data from run history, the findings table.

What you get from them
Inventory, data, findings table

We assign work by complexity: juniors do routine work from templates, the middle takes the harder parts, and the senior owns the design, quality control and risk decisions. You do not need to decide who does what. The effort in days is indicative and only explains the price. The price is fixed and does not depend on the days actually worked.

How the project runs

The audit has four phases and takes 10 working days from the moment we get access to the repositories.

Days 1 and 2: kick-off and inventory
Goal: Get access and an overview of everything we will assess.
- Kick-off: goals, repositories in scope, known problems.
- Read-only access to the repositories and the CI platform.
- Inventory of pipelines, runners, deployment targets and secret usage (metadata only, we do not read values).
- Interviews with 2 to 3 people (development, operations, security).
Output: Inventory and confirmed scope. Who: junior inventory, senior interviews
Days 3 to 6: analysis
Goal: Go through the pipelines in eight areas and verify the findings.
- Pipeline review against our checklist.
- Run history analysis: duration, success rate, flaky steps.
- Verification of findings on concrete examples.
Output: Verified findings. Who: middle analysis, junior data
Days 7 to 9: priorities and recommendations
Goal: Turn findings into a plan.
- A priority for each finding (critical, high, medium, low).
- Recommendation and effort estimate.
- Quick wins and a description of the target state.
Output: Report and findings table. Who: senior, estimates by the middle
Day 10: readout
Goal: Hand over the results and agree the next steps.
- A 60 minute presentation of the results to your team.
- Handover of the report and the findings table.
Output: Report handed over. Who: senior

How we work together

Main contact: The project lead (a senior). Accountable for the result, deadlines, risks and decisions. Day to day you can talk to anyone on the team directly.
Communication: A shared Slack or Teams channel and a ticketing system of your choice. Every question and change leaves a trail.
Kick-off: At the start we confirm the scope, access, contacts and the dates of the key milestones.
Weekly status: A short 15 to 30 minute sync: what is done, what is next, what we need from you and which risks we see.
Final readout: We present the results to your team and management and go through the next steps.
Escalation: Junior → middle → project lead. If a deadline or a major risk is at stake, the project lead contacts you the same day.
Working hours: Working days, 8:00 to 17:00 Central European Time. Production changes happen in a window you choose, always through your change management.

What we need from you

The timeline holds if we have the following. If something is delayed, the schedule moves by the same time and we tell you straight away.

Read-only access to the repositories and the CI platform, including settings and run history.
The list of repositories in scope (up to 15).
2 to 3 people for 45 minute interviews.
A description of your release process, if one exists.

Access and security

Every team member has their own named account. We do not use shared accounts.
We ask only for the permissions a phase needs. Where read access is enough, we work read-only.
We do not take data out of your environment. Our documents contain only the summaries the result needs.
When the project ends, you remove our access, or we remove it on request and confirm it.
If you wish, we sign an NDA before the kick-off.

What is included and what is not

Included in the price

Up to 15 repositories and one CI platform
Assessment in eight areas
Report, findings table, delivery metrics (if the data exists)
Readout

Not included: priced separately or on your side

Fixing the findings (can follow as CI/CD implementation or DevSecOps in the pipeline)
Application code audit and penetration tests
Assessment of infrastructure outside the pipelines

If we find during the project that reality differs from what we assumed, we tell you before we work outside the scope. We send a short estimate of the impact on price and timeline and continue only once you agree.

Deliverables and acceptance

Deliverable	Contents	Form
Report	Assessment of eight areas, findings, recommendations, target state	PDF and Word
Findings table	Priority, description, recommendation, effort	Excel ready to import into your backlog
Delivery metrics	Deployment frequency, lead time, change failure rate	Part of the report
Readout	Presentation of results	Meeting and PDF

The project is done when:

We have handed over the report and the findings table.
The readout has taken place.
We have incorporated your comments from one round.

We hand over the deliverables and go through them with you. We incorporate comments in one round within 5 working days of receiving them.

Risks and how we handle them

Risk	How we handle it
Run history is not available	We estimate the metrics from interviews and mark them as estimates.
There are more than 15 repositories	A surcharge of about CZK 25,000 for every further 10 repositories or another CI platform, confirmed by you in advance.
Concerns about access to secrets	We do not read secret values, we only check how they are used.

Price and terms

CZK 85,000 excl. VAT, fixed price (up to 15 repositories and one CI platform).

Duration: 2 weeks.
Prices exclude VAT, invoiced in CZK or EUR.
Work outside the scope: a separate quote, always in advance.

What can follow

Next steps

1A short 30 minute call: we look at your environment and check that the service fits what you need.
2We confirm the scope, the start date and the contact people.
3We send the contract and the list of access we need to start.

Frequently asked questions

Will you see our secrets?

No. We check how and where secrets are used, not their values.

Can we use the results for an audit?

Yes, the report also works as evidence for an auditor.

Do we then have to order the fixes from you?

No. The recommendations are written so that your team can handle them.

Tell us what you are working on.

Thirty minutes, free. We reply within one working day.