Secure code review.

A penetration test finds what is exploitable from outside. A code review finds what is latent inside, including the flaw that is currently unreachable and will become reachable in the next release.

Get a quote Sample report

At a glance

Typical duration: 1 to 3 weeks by codebase size
Approach: Manual review, tool-assisted
Languages: Confirm your stack at scoping
Output: Findings mapped to file and line
Retest: Included

01Overview

What we look for.

Static analysis tools produce volume. A senior reviewer produces judgement. We use tooling to narrow the search space and then read the code that matters: authentication, authorisation, cryptography, and anywhere untrusted input meets a dangerous sink.

02Coverage

What we test.

Authentication and authorisation logicHow identity is established and how every subsequent decision uses it, including the checks that were never written.

Cryptographic implementationAlgorithm and mode selection, key generation and storage, initialisation vectors, randomness sources, custom cryptography.

Injection sources and sinksData flow from every untrusted input to every dangerous operation, including paths tools cannot follow.

Secrets handlingCredentials in source and history, configuration management, secret rotation and logging of sensitive values.

Input validation and encodingValidation placement, canonicalisation, output encoding by context, serialisation boundaries.

Error handling and loggingInformation disclosure through errors, sensitive data written to logs, failure modes that default to permissive.

Dependency riskKnown vulnerable packages, unmaintained libraries, transitive dependency exposure, lockfile integrity.

Business logicRace conditions, state machine gaps, idempotency of financial operations, trust assumptions between services.

03Deliverables

What you receive.

01Executive summary

Risk posture in plain language for leadership and the board, with the two or three things that actually matter.

02Technical findings

Severity, proof-of-concept evidence, reproduction steps and specific remediation, written for the engineer who has to fix it.

03Compliance annex

Findings mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls so your auditor can use the report directly.

04Attestation letter

A shareable letter confirming scope, dates and outcome, reissued free after we verify your fixes.

04Fit

Who needs this.

Teams shipping security-critical code such as payments, authentication or cryptography
Products where a logic flaw would be expensive and hard to detect
Anyone who has inherited a codebase and does not know what is in it
Regulated software where the auditor expects source-level assurance
Organisations that want depth beyond black-box testing

05Questions

Frequently asked.

Do we have to give you our source code?

Yes, that is the engagement. We work under NDA, access is limited to named reviewers, and we can work inside your environment or on a time-limited repository copy, whichever your policy requires.

Which languages do you cover?

Confirm your stack with us at scoping. We will tell you plainly whether we have senior reviewers for it rather than accepting the work and learning on your codebase.

Is this just running a SAST tool?

No. Tooling narrows the search space and we say so openly. The value is a reviewer reading authentication and authorisation logic and asking what happens if this check is absent, which no tool does.

Should we do this or a penetration test?

If you can only do one, do the penetration test, because it proves impact. Do the code review when you need depth on critical logic, or when you want to find issues before they become reachable.

06Next

Related services.

SVC 01Web Application

Your web application is your largest attack surface and the one your customers touch. We test it the way an attacker would: authenticated, unauthenticated, and everywhere your framework defaults do not reach.

SVC 02API Testing

Your mobile app and your single-page front end are just API clients. The API is the real target, and it is usually tested least. We test REST, GraphQL and the authorisation logic underneath both.

CMP 02ISO 27001

The international standard for information security management. Heavier than SOC 2 up front, more durable afterwards, and the one European and Asian enterprise buyers recognise immediately.

Ready to find out what an attacker would find?

Tell us about your environment and we will come back with a scoped quote and a start date. No discovery-call marathon, no obligation.

Get a pentest quote Talk to a consultant