A ten-year-old ERP, and an eight-hour fix list.
The challenge
The whole factory runs on a custom PHP system from 2015: production orders, dyeing, galvanisation, assembly, stock. The original developer was gone and nobody could say how risky it was to touch. Management wanted to know: is it safe to keep, and what needs fixing first?
What we did
One senior engineer, backed by AI coding agents. We indexed the codebase — 50,000 lines, 200 files, 50 database models — into a dependency graph with Graphify, then ran agent-driven static analysis across every endpoint and query in parallel. That compressed weeks of reading into days and left the engineer’s time for judgement: deciding what actually matters against the real threat model, an internal network behind a VPN. The client received a plain-language report with a scorecard and a prioritised list of fixes, each sized in hours.
What we found
The code was better than feared. The risks were few, concentrated, and quick to fix.
| Area | Finding | Severity |
|---|---|---|
| Password storage | MD5 hashes, reversible in seconds | High |
| Database credentials | Hardcoded in source, connecting as root | High |
| Server stack | PHP 7.4 and MySQL 5.7, both end-of-life | High |
| Automated tests | None | High |
| Form protection | No CSRF tokens; low exposure on a closed network | Medium |
The result
- 3
- critical issues found
- 8h
- to close all three
- 24h
- of improvements ready to start
The technical write-up
The same assessment, written for an engineer: how the codebase was indexed before it was read, and why severity only means anything against the deployment you actually have.
Read it on Corvale EngineeringStart with a straight answer.
A fixed-price technical assessment, with no commitment afterwards. Or simply book a call.