Step 01 of the walk · The problem

Every codebase is optimising for something. Almost nobody measures what.

Speed of delivery, safety at a boundary, throughput under load, the ability of the next person to change it: code cannot maximise them all at once, so every file quietly trades some away to get others. That set of trades is the code’s profile. It exists whether anyone chose it or not - and when nobody chooses it, the deadline chooses it.

The part nobody tells you

“Is this good code?” has no answer, because a quick one-off script and a payment boundary should not be built the same way. What has an answer is: what is this code optimised for, and is that what it needs to be optimised for? Nothing in a normal toolchain asks that question. Tests check behaviour. Linters check style. A single quality score averages the trades together until they disappear.

So the profile goes unmeasured. Here is what the unmeasured version costs.

The bill, as documented

$2.41TThe estimated cost of poor software quality in the US in a single year (2022).CISQ 2022 [1]

$1.52TAccumulated technical debt sitting unpaid in US software - the rework nobody scheduled.CISQ 2022 [1]

42%Of the average developer week spent on maintenance and bad code - 17.3 hours - rather than building.Stripe [2]

20-40%Of the value of the entire technology estate that CIOs estimate their tech debt amounts to.McKinsey [3]

These are different methodologies measuring the same underlying fact: unexamined trades compound into a liability, and the liability is enormous. The receipts for every number on this page are listed at the foot.

If you build fast with AI

Shipping fast is not the mistake. Shipping fast is the correct trade for a prototype - speed is a profile. The mistake is not knowing you made a trade at all.

The ledger you did not know you were signing

The evidence on AI-assisted codebases is specific. Across 211 million changed lines of real code, duplicated code blocks rose eightfold in 2024, and for the first time on record copy-pasted lines outnumbered refactored ones^[6]. Refactoring - the work that keeps a codebase changeable - fell from 25% of changed lines to under 10% in four years^[6]. On security: across 80 curated tasks and more than 100 models, AI-generated code introduced a known vulnerability class in 45% of them^[4]. And in a controlled Stanford study, developers using an AI assistant wrote measurably less secure code while believing more strongly that it was secure^[5].

Play that forward for a solo builder. The prototype works, users arrive, and the profile you never chose starts presenting its bill: the codebase resists change (that is the lost refactoring), the cloud bill climbs (nobody optimised for efficiency because nobody knew it was a dimension), and the first attacker who wanders past finds the 45%. The product that cannot scale is not the one that failed - it is the one that succeeded on top of trades nobody inspected.

If you run an organisation

For a team, an unmeasured profile is not an abstraction. Each dimension nobody optimised is a specific category of incident waiting for a date.

Left unmeasured	What it costs when it lands	Receipt
Security posture	The global average cost of one data breach is US$4.44 million - and that is the average, not the ceiling.	IBM 2025 [7]
Change safety	One dead code path revived by an untested deploy cost Knight Capital US$440 million in 45 minutes. The firm did not survive the week independently.	SEC 2013 [8]
Maintainability	CIOs report 10-20% of the budget meant for new products is quietly diverted to servicing old trades.	McKinsey [3]
All of it, in aggregate	Roughly $85 billion per year in developer time spent specifically on bad code - before counting incidents.	Stripe [2]

None of these organisations lacked talent. They lacked a reading of what their code was optimised for, taken before the incident instead of in the post-mortem.

Why a score cannot catch it

The obvious fix - grade the code, watch the grade - fails for a structural reason: a single number has to average the trades together, and the trades are the signal. A security boundary with superb performance and a missing input check can score the same “7/10” as a slow, bulletproof one. The first is a breach waiting; the second is fine. The average is blind to the difference by construction.

A profile keeps the dimensions apart, so the question changes from “how good?” to “optimised for what - and is that what you meant?” That is a question with an actionable answer, and it is the question the rest of this site is built to let you ask. The next step shows it running on real code: the same problem solved five ways, and why each one reads differently.

Next: see it run Not sure what your code should optimise for? Take the two-minute interview

Receipts

Every figure above, with where it comes from and what was measured. Methodologies differ; none of them is ours; all of them point the same way.