Key points
- Finds the classes of bug that black-box testing misses — a race condition, a missing check on one of nine call paths, a weak random source.
- SAST output is triaged for you: false positives removed, real issues confirmed and prioritised.
- Every finding comes with the fix expressed in your language and framework.
- Pairs well with a penetration test: the review explains why the exploit worked.
Black-box testing tells you a door is unlocked. Code review tells you that the lock is checked in eight places and forgotten in the ninth — and shows you the ninth. It is the fastest way to find systemic weaknesses rather than individual symptoms.
What the engagement covers
Authentication and session code
Password hashing parameters, reset and verification token generation and lifetime, MFA enforcement paths, session creation and invalidation, and the "remember me" implementation nobody has read since it was written.
Authorisation enforcement
Every entry point traced to its authorisation check: middleware coverage, policy and guard usage, ownership checks on object queries, and the endpoints that quietly bypass all of it.
Cryptography usage
Algorithm and mode choices, IV and nonce handling, key storage and rotation, random source quality, and the home-grown encryption helper that should be replaced with the platform primitive.
Injection sinks and input handling
Raw query construction, template rendering, command execution, deserialisation, path handling and file uploads — traced from source to sink rather than pattern-matched.
Secrets and configuration
Committed credentials across the full git history, environment handling, debug flags reachable in production, dependency vulnerabilities and unpinned supply chain risk.
Business-critical flows
Payment, refund, credit and quota logic reviewed for race conditions, integer and rounding errors, replay windows and idempotency gaps.
How it runs
-
01
Architecture walkthrough
One session with a developer to learn the trust boundaries, entry points and the parts of the codebase that worry the team.
-
02
Automated pass
Semgrep, dependency and secret scanning run first, purely to build a map of candidates.
-
03
Manual review
Security-critical paths read line by line, with data flow traced from every external input to every dangerous sink.
-
04
Confirmation
Candidate issues proven in a running instance where possible, so nothing lands in the report as theoretical.
-
05
Report and pairing session
Findings delivered with file and line references, plus a working session where the first fixes are written together.
-
06
Re-review
Fix commits reviewed free within 30 days to confirm the change closed the issue and did not move it.
What you receive
- Findings with file, line and call-path references
- Suggested fix as a diff or code snippet in your stack
- Triaged SAST results with false positives removed
- Dependency and secret exposure report across git history
- Secure-defaults checklist wired into your code review process
- Free re-review of fix commits
Who this is for
- Teams inheriting a legacy codebase
- Products handling money or health data
- Pre-funding or pre-acquisition technical due diligence
- Teams that keep shipping the same bug class
Questions about this engagement
Do you need our whole repository?
Read access to the relevant services is enough, and a signed NDA comes first. Where policy forbids code leaving your environment, review can be done on your infrastructure over a screen-shared session.
Which languages do you review?
PHP, Dart, Kotlin, Swift, JavaScript and TypeScript, Python and Go. For anything else, the review is scoped narrowly to the security-critical paths and confirmed with your engineers.
Is this instead of a penetration test?
They answer different questions. The test proves what an attacker can do today; the review explains why it was possible and what else shares the same weakness. Together they cost less than repeating either twice.
Can this run inside our CI?
Yes — the engagement can end with tuned Semgrep rules and a pre-merge security gate, so the same bug class fails the build next time instead of reaching a report.