Authentication & session
Credential handling, password storage and comparison, token issuance and verification, session lifecycle, and every path that can produce an authenticated context.
Secure source code review
Static analysers are good at patterns and bad at intent. We read the code paths that decide who is allowed to do what, and trace each finding from source to sink and back out to the request that reaches it.
Scope
Where we look first
Reviewed by hand, with automated tooling used to widen coverage rather than to produce the findings.
Authorisation
Where access decisions are made and, more importantly, where they are skipped — missing middleware, direct object access, and inconsistent checks between the API and the UI.
Cryptography
Algorithm and mode selection, IV and nonce reuse, key management, randomness sources, and homegrown constructions that should not exist.
Injection sinks
Query construction, command execution, template rendering, deserialisation and file path handling — each traced back to whether user input can reach it.
Dependencies & supply chain
Known-vulnerable packages that are actually reachable from your code, lockfile integrity, and build-pipeline trust.
Secrets in history
Credentials committed and later deleted — still present in git history, and still valid more often than anyone expects.
Every engagement ships with
- Executive summary written for leadership
- Findings referenced to file, line and commit
- Source-to-sink trace and a reachable proof of concept where one exists
- CVSS v3.1 vectors and business-impact narrative
- Concrete remediation, including suggested patches where useful
- Live debrief with the engineers who own the code
- Free re-review of fixed findings within 90 days
- Signed attestation letter for auditors and customers
FAQ
Questions about this service
Do you need full repository access?
Read-only access to the repositories in scope, including history. We can work inside your environment or from a clone, and everything is destroyed at the end of the engagement on request.
Which languages do you cover?
Commonly JavaScript and TypeScript, Python, Java, Go, PHP, Ruby and C#. If your stack is outside that list, say so on the scoping call — we will tell you honestly whether we are the right people for it.
Is this instead of a penetration test?
They complement each other. Code review finds flaws that are hard to reach from outside; penetration testing proves what is actually exploitable in a running system. Together they cover far more than either alone.
Next step
Find out what an attacker would find.
Tell us what you have built. You get a reply within one business day, an NDA, and a free 30-minute scoping call with the person who will do the testing.