Secure Source Code Review

Tooling and standards

We use commercial and open-source static analysis to get coverage — SonarQube, Semgrep, and language-specific analysers as appropriate — then review manually, because static analysis cannot understand your business logic and generates a false positive rate that makes unreviewed output useless.

Findings are assessed against the OWASP Application Security Verification Standard and classified using CWE, with the CWE Top 25 and OWASP Top 10 as the priority lens.

Where we focus

• Authentication and session management — credential handling, token generation and lifetime, session fixation and invalidation.
• Authorisation — particularly broken object-level and function-level access control, which automated tools consistently miss.
• Input handling — injection across SQL, command, LDAP and template contexts; deserialisation; file upload handling.
• Output encoding and cross-site scripting across all rendering contexts.
• Cryptography — algorithm selection, key management, random number generation, and data protection in transit and at rest.
• Secrets management — hard-coded credentials, keys in source control, configuration exposure.
• Business logic — the flaws unique to your application that no scanner has a rule for.
• Third-party dependencies — known vulnerable components and supply chain exposure.

How we handle your code

Under NDA, on encrypted storage, with access limited to named reviewers. Review can be performed on your infrastructure if your policy requires the code never to leave your environment. All copies are destroyed at engagement close and we provide written confirmation.