Source Code Review
We read your application code, by hand and with tools, to find security flaws before they reach your customers.
Who it is for
- Software teams about to release, or that have just built a new feature
- Companies that bought or inherited code and want to know what is in it
- Teams that want a second pair of eyes on login, payments or data handling
What you get
Findings with the exact code location
So developers can go straight to the problem.
An explanation of why it matters
Written for developers and for the people who sign off the risk.
Suggested fixes
Example changes where they help, so fixes are quick.
Notes on patterns, not only single bugs
Where the same mistake repeats, we say so, so you can fix it once.
How an engagement runs
Free consultation
A short call to understand what you run, what worries you and any deadlines.
Scope and quote
We agree what is in and out of scope, the dates and the cost in writing before work starts.
Assessment
We review the agreed code by hand, supported by automated tools, with extra attention on login, access control, data handling and cryptography.
Report and debrief
You receive the written report, and we walk your developers through it.
Fix and re-check
You fix what matters most. We can check the fixes and update the report.
Typical duration:To be confirmed: typical duration
Sample deliverable
A redacted excerpt of a code review finding will appear here. To be confirmed: approved redacted sample.
Packages
Every engagement is quoted from its scope. The quote is fixed in writing before work starts.
Focused
One component or a few high-risk areas, such as login and payments.
Contact us for a quote
Ask about this packageComprehensive
Several applications or services, with a re-check included.
Contact us for a quote
Ask about this packageFrequently asked questions
How long does a source code review take?
It depends on the size of what we are looking at. We give you dates in the written quote before you commit.
How much does it cost?
Contact us for a quote. We price each engagement from its scope, and the quote is fixed in writing before work starts.
Will you disrupt our systems or staff?
We agree the rules of the engagement with you first, including when testing may happen and what must not be touched.
Which languages can you review?
Tell us what you use on the free consultation. To be confirmed: confirmed list of languages and frameworks.
Do you keep a copy of our code?
We agree how code is shared, stored and deleted with you in writing before we start.
Ready to talk?
Book a free consultation. We will ask about your systems, answer your questions and, if it suits you, send a written quote.