Before we move a line of your code, we write a test suite that pins what the application does today. That suite is the thing that makes an upgrade safe. You can also buy it on its own, and most owners should.
An old application that has outlived its documentation has one real problem: nobody can say what it does. Not the owner, not the current developer, often not the person who wrote it. Every proposal to change it is therefore a guess, and every estimate carries a silent margin for the surprise nobody can name.
A characterization suite removes the guess. It is a set of tests written against the application as it behaves now, including the parts that are wrong, so that any later change either keeps that behaviour or tells you loudly that it did not. It is the only honest way to learn what an undocumented application really does, because it asks the application rather than the code.
We sell it separately for three reasons. It is where most of the work in any migration actually goes. It is what finds the defects that are hurting you today. And it is the one deliverable that keeps its value whatever you decide next, including deciding to do nothing, to hire somebody else, or to keep the application exactly as it is.
We ran this on our own Laravel 7 back end first, so we could publish the results rather than describe them. Reading the code had already produced nine findings. Writing 53 tests against the running application found seven more that reading had missed entirely.
| What the tests found | Who notices today |
|---|---|
| Follow-up notes could be written against any record with no authentication at all | Security issue, nobody had noticed |
| Any logged-in account could change any other account’s records by guessing an id | Multi-tenant data issue |
| Leads arriving by webhook never appeared anywhere in the application | The owner, if that is the live intake path |
| Both logout endpoints threw an exception on every call | Nobody, because the front end never used them |
| The “yesterday” filter also returned today | Anyone comparing two views |
| The “all time” filter silently meant the last 300 days | The owner, once data ages past ten months |
| Three scaffolded pages returned a server error on every request | Nobody, dead code to delete |
Three of those are security problems. Two of them mean the application was quietly losing or hiding data. None of them were visible from reading the code, and none of them had been reported by a user, which is the normal state of affairs: an old application’s defects are the ones nobody has a name for yet.
The suite also recorded a set of behaviours that are not bugs but must survive any change, such as a database engine that adds whitespace inside stored JSON and a date field that returns two different shapes depending on how it was written. Both would have broken the front end during an upgrade, silently, and neither is the kind of thing anybody writes down.
This matters more than the list above, because a test suite is easy to oversell.
From $3,500, fixed, quoted after the assessment. The number follows the number of boundaries the application has rather than its line count: routes, webhooks, queued jobs, scheduled commands, emails, PDFs and anything with a payment provider on the other end. Integrations are what make pinning behaviour expensive, because the fixtures have to be built against the provider’s own test mode.
It is credited in full against a migration if you order one within ninety days. If you never order one, you still own the suite.
Nothing in your application changes. Nothing is deployed. The only commits are test files and a CI configuration.
If you are on PHP 8.1 or older, start with the $750 exposure check instead, because the version question is urgent and the answer may change what you do first. Otherwise this is the right first purchase.
Ask what this would cost for your application See a sample report