01
Automated analysis (SAST)
Injection, XSS, unsafe functions and misconfiguration across the whole codebase.
Source Code Review
We read your application’s code line by line and find vulnerabilities before release, where they are cheapest to fix.
What it is
A source code review looks for vulnerabilities from inside the application rather than from outside. We scan all of the code with automated analysis tools, then review the critical parts by hand, such as authentication, authorisation, data handling and cryptography. That finds flaws a penetration test cannot see from outside, and for every finding we show which line to change and how.
What we cover
0602
Expert review
Manual review of authentication, access control, sessions and business logic.
03
Dependencies (SCA)
Known vulnerabilities and licence risks in the libraries you use.
04
Secrets
Passwords, API keys and certificates written into the code or the repository history.
05
Cryptography and data
Password storage, use of encryption and how personal data is handled.
06
Infrastructure as code
Security settings in Dockerfiles, Kubernetes manifests and Terraform.
How we work
- 01
Scope
Repositories, languages, critical modules and the architecture are agreed together.
- 02
Automated scans
SAST, dependency and secret scans run, and false positives are removed.
- 03
Expert review
Critical flows are read by hand and assessed against attack scenarios.
- 04
Report and fixes
Every finding comes with file, line and an example fix.
- 05
Built into your pipeline
If you like, we add the scans to your CI/CD so they run on every change.
What you get
- A list of findings with file and line
- Risk level and an example fix for each finding
- Vulnerable dependencies and upgrade advice
- Optional: automated security scans added to your CI/CD
When you need it
- Before a critical application goes live for the first time
- When you take over code from another team or supplier
- For modules that handle payments, identity or personal data
- When a customer or auditor asks for evidence of secure development
Methodologies & Standards
OWASP ASVSOWASP Top 10OWASP Code Review GuideCWE Top 25SASTSCA
Frequently Asked
The code is reviewed only for the analysis, under an NDA and through the access method you choose. If you prefer, we run the review inside your environment so the code never leaves it.
Most languages common in web and mobile applications, for example JavaScript/TypeScript, PHP, Python, Java, C#, Go, Kotlin and Swift. We confirm your languages when we agree the scope.
No, the two complement each other. A code review finds where a flaw sits in the code; a penetration test shows whether it can be exploited on the running system. For critical applications we recommend both.
Related industries
More services in Cybersecurity
All ofCybersecurity- Penetration TestingWe find the gaps in your web, mobile, API and network before an attacker does.
- Wireless (Wi-Fi) Security TestingWe test how exposed your office and guest Wi-Fi are to someone sitting in the car park.
- DDoS Resilience TestingWe measure, in a controlled way, whether your site and app stay up under heavy attack traffic.
- Phishing SimulationWe send your staff realistic fake e-mails, then raise awareness with short training.
- Active Directory and Internal Network TestingWe show how quickly an attacker inside your network could get from one laptop to the whole company.
- Cloud Security ReviewWe find public storage, excessive permissions and risky settings in your cloud accounts before an attacker does.
