The 7-Day Infrastructure Audit
A focused review of your DevOps, SRE or validator infrastructure. Delivered in one week. Fixed price. Clear deliverables. No long engagement required.
30 minutes. No pitch, no pressure.
Two audits, one methodology
We run two flavours of the audit, depending on what you operate.
Infrastructure Audit
For DevOps and SRE teams running on AWS, GCP or Azure.
We review your CI/CD pipelines, observability stack, incident response, deployment processes, and cloud architecture. You get a written report with prioritised findings and a 90-minute debrief call.
Best for: SaaS teams scaling past their first 10 engineers, fintechs preparing for SOC 2, or any team that has been firefighting more than shipping.
Validator Infrastructure Audit
For Web3 teams running validator nodes on Cosmos, Ethereum, Solana or any major chain.
We review your slashing protection, sentry topology, key management, monitoring, on-call setup, and incident runbooks. You get a written report with prioritised findings and a 90-minute debrief call.
Best for: validator operators preparing to scale stake, projects launching their own validator set, or teams that want a second opinion before a mainnet upgrade.
What you get
Both audits include the same four deliverables.
- Kick-off call (60 min). We map your current setup, your incident history, your concerns.
- Deep dive (3-4 days, on our side). We review code, configs, infrastructure-as-code, runbooks, monitoring dashboards, and post-mortems.
- Written report. Prioritised findings with severity, business impact, and concrete remediation steps. Not a generic checklist. Your report.
- Debrief call (90 min). We walk you through the findings, answer questions, and help you scope the next steps.
What you don't get: a 200-page PDF nobody reads, a sales call disguised as an audit, or a list of generic best practices copied from somewhere else.
How a typical week looks
Kick-off call. NDA signed if needed. Read access granted to your repos, infra, dashboards.
Deep dive on our side. Async questions over Slack or email.
We send the draft report. You read it.
Debrief call. We discuss findings, answer questions, agree on what to do next, if anything.
If you want to engage us to fix what we found, great. If not, you keep the report. No pressure either way.
Cases where this work has shipped
We have run audits and embedded engineers across SaaS and Web3.
$4,500 fixed
7 days. Either audit type.
Included: 60-min kick-off call, 7-day review window, written report with prioritised findings, 90-min debrief call, 14 days of Slack/email follow-up for report questions.
Not included: Implementation of the findings (we can quote separately). Audits longer than 7 days (we scope custom engagements for those).
Refund policy: If after the kick-off call we determine the audit is not a good fit for what you need, we refund 100%.
Who runs the audit
The audit is run by a senior engineer at The Good Shell. One engineer per audit, end to end. No outsourcing, no junior delegation.
Background covers validator infrastructure for Cosmos and Ethereum operators, reliability programs for SaaS teams under SOC 2 pressure, and production observability across Web3 and SaaS stacks. See our case studies for examples.
FAQ
What if I don't have everything documented?
That is fine, that is often the audit finding. We work with what you have.
Do you sign an NDA?
Yes, mutual NDA on day 1 by default.
What access do you need?
Read-only access to repos, IaC, monitoring dashboards, and incident history. We do not need production write access for the audit itself.
What happens after the audit?
You get the report. If you want us to help you fix things, we scope it separately. If not, no follow-up sales pressure.
Can we do this for a multi-chain validator setup?
Yes. The validator audit is chain-agnostic. We have experience with EVM, Cosmos SDK, and Solana.
Why 7 days and not longer?
Because audits longer than a week start producing diminishing returns and turn into consulting engagements. 7 days forces focus on what matters.
Ready to start?
Book a 30-minute discovery call. We will tell you whether the audit makes sense for your situation, and which of the two flavours fits.
No pitch, no pressure. If the audit is not right for you, we will say so.