Fifty Repos, Fifty Lessons: What a Year of Auditing British SME Codebases Taught Us

The audit nobody asked us to do

Over the past year, we've had the (occasionally painful) privilege of poking around fifty codebases belonging to UK small and medium-sized businesses. Some were agency builds inherited from clients. Some were internal tools held together by one overworked developer and a prayer. A few were genuinely excellent.

We didn't set out with a hypothesis. We just took notes. Lots of notes. And the patterns that emerged were too useful to keep to ourselves.

The .NET farms of the North aren't going anywhere

Start in Manchester or Leeds and you'll find a surprising number of businesses still running on .NET Framework 4.x, deployed to on-prem IIS servers humming away in a comms cupboard. Before anyone sneers: most of these systems work. They process orders, they generate invoices, they've survived three office moves and a pandemic.

The problem isn't the stack — it's the stagnation. In roughly two-thirds of the legacy .NET projects we reviewed, nobody could tell us which parts of the codebase were actually load-bearing. Documentation was rare. Tests were rarer. One firm in Stockport had a single integration test, and it tested a payment sandbox that had been decommissioned in 2019.

The lesson: migration to .NET 8 isn't the priority. Building a safety net first is. You can't refactor what you're afraid to touch.

Shoreditch startups: fast to ship, slow to clean

London's startup scene tells the opposite story. Node.js, TypeScript, Next.js, Postgres on a managed cloud — modern stacks, deployed continuously, often very well engineered at the service layer.

Where these projects fall down is everywhere else. Half of the Shoreditch-era codebases we saw had infrastructure defined in someone's head rather than in code. Secrets lived in .env files committed to Git in at least eight projects — yes, eight, and yes, we told them. And dependency hygiene was grim across the board: projects running packages three major versions behind, with npm audit warnings treated as wallpaper.

Modern doesn't mean maintainable. It just means the debt is newer.

The agency effect is real

A huge chunk of the code we reviewed was agency-built, and you could spot it within minutes. Multiple conflicting architectural patterns — a bit of DDD here, a fat controller there, a repository layer that only half the models use. That's not necessarily sloppiness; it's different teams, different sprints, different clients breathing down necks.

If you're an SME buying agency work, insist on two things: architecture decision records and a handover that includes a real deployment run-through. If you're an agency, stop pretending the client will never come back. They always come back.

Tech debt has a postcode

One thing the data made clear: technical debt in UK SMEs correlates less with company size and more with who's accountable. Businesses with even one permanent senior developer on staff had measurably healthier repos — fewer critical vulnerabilities, better CI pipelines, actual branching strategies. Businesses relying entirely on contractors churned through architectures every eighteen months.

If you're a contractor reading this: leaving documentation and a working pipeline behind is the single highest-value thing you can do. It's also, selfishly, great for your reputation in a market where everyone knows everyone.

Five things to do this quarter

Based on what we saw, here's the honest checklist for any UK SME dev team:

1. Get your secrets out of Git. Rotate anything that's ever been committed. It takes an afternoon and could save you a breach notification to the ICO.
2. Write down what the system actually does. Not aspirational documentation — a rough map. Future-you will weep with gratitude.
3. Add one meaningful test per week. Not 80% coverage tomorrow. One test. Every week.
4. Pin your dependencies and schedule upgrades. Most of the vulnerabilities we found were known and patched upstream.
5. Ask who owns this code. If the answer is a shrug, you've found your next project.

The encouraging bit

Here's what surprised us most: the mood. Despite the debt, despite the legacy servers in cupboards, the developers we met cared enormously about their work. UK SME software isn't broken — it's under-resourced and understaffed, which is a fixable problem.

Fifty codebases later, our conclusion is simple. The best-run projects weren't the ones with the fanciest stacks. They were the ones where somebody, somewhere, had made the case for maintenance and been listened to. Be that somebody.