Turning a healthcare AI company's audits into a ranked roadmap
A healthcare AI company had a long backlog and no clear order of work. I audited all 11 codebases and ranked what I found together with the founder. Now the team builds from 28 planned items in priority order, and the founder's own task list lives in the same roadmap.
Healthcare AI company · · 4 min read
Context
A healthcare AI company that gives clinicians safe access to leading AI models for clinical notes and transcription. Patient privacy rules shape every technical decision.
The founder had a capable team and a long backlog, but no ranked plan and no independent view of the security risks across the codebases. I joined as Fractional CTO in April 2026 to audit the stack and set the order of work.
What I did
- Audits of every codebase. Reviewed all 11 codebases for exposed secrets, sign-in weaknesses, patient data in logs and outdated dependencies. I also ran a technical debt audit and a review of the business rules, so every risk became a tracked item.
- A ranked roadmap with written plans. Built a roadmap of 28 engineering and security items. Each one has effort, impact, priority and an owner, plus a written plan I checked against the live code before handing it over.
- One list for everything. Merged 190 items from the founder's own task list into the same roadmap. Priorities also sync automatically to spreadsheets, so the founder can follow them without opening a code tool.
- Ranking session with the founder. Re-ranked the top items live with the founder, using what I had confirmed in the code. A sign-in weakness in one backend service moved up to second place once I confirmed it.
- Access and data checks. Tightened the code hosting account so members no longer get read access to every private codebase by default. I also checked a suspected patient-data exposure and confirmed it was test data.
- API documentation check. Compared the public API documentation with the code and listed every place they disagreed, so partners building on the API get accurate answers.
Results
Before
After
Before
No independent view of security risks across the codebases.
After
A security audit covering all 11 codebases, with each finding tracked.
Before
A long backlog with no agreed order.
After
28 ranked items, each with effort, impact, an owner and a written plan.
Before
The founder's tasks lived in a separate list.
After
190 founder tasks merged into the same roadmap.
Before
Priorities lived in files only engineers opened.
After
Priorities sync to spreadsheets the founder can open anytime.
Before
Every member of the code hosting account could read every private codebase.
After
Members only get access to the codebases they are given.
Before
A suspected patient-data exposure with no clear answer.
After
Checked and confirmed it was test data.
What comes next
This engagement is ongoing. Next, I help the team work through the ranked security items in order, starting with the highest risks, and prepare for a SOC 2 security audit. I also keep the roadmap and the API documentation in step with the code as it changes.
Your developers are busy and the product is stuck?
Book a free 25-minute call to see whether working together makes sense.
Prefer writing? Email me at hello@nicolascava.com. I'll reply within one business day.