Home/ Questions/Q 6552871
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T12:30:46+00:00

A client is asking how long does it take to audit the security of

  • 0

A client is asking how long does it take to audit the security of his Drupal module that is 29k lines long. Does anyone know at least what ballpark I should give him? His main concerns are file encryption and user permission.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Nope, not a damn clue 🙂

    However, whatever value you choose, may I suggest one thing?

    Monitor your progress! Tell your client that your initial estimate is (for example) twenty-nine working days but that it depends on a great many factors outside your control.

    Tell them you plan to mitigate risks of budget overrun by providing a daily snapshot of progress:

    • current number of lines audited in total [a].
    • days spent [b].
    • current “run rate” (number of lines per day, average) [c = a/b].
    • number of lines yet to be audited [d = 29,000 – a].
    • estimated days to completion [e = d / c].

    Allow them to pull the plug at any time if the run rate is well below what you estimated.

    This basic project management/reporting should give them the confidence that you know what you’re doing, and will minimise their exposure considerably, to the point where they’ll feel a lot more comfortable about taking you on.

    Just on that last bullet point above, you may want to consider giving them a range (say +/-5% of the estimate), but don’t get too clever about working out best and worst case based on your best and worst days to date. The power of averaging is that it gives you a “best” guess without having to fiddle too much with figures.

    • 0