Authentication and permissions
How users are identified, how sessions are handled, and how access to features and data is restricted.
01 / AI-driven code review
AI-driven analysis.
Safer code.
AI-driven analysis and independent specialist review of your source code. We review both in-house and AI-generated code, and examine security-critical logic, dependencies and sensitive access credentials.
01Source code and dependencies
02AI-driven analysis and specialist review
03Code references and remediation proposals
This is what we review
The right questions for your code.
The analysis is adapted to the language, framework, architecture and the information the system protects.
Input and output
How data from users and other systems reaches database queries, templates and other security-critical functions.
Keys and cryptography
Keys, access tokens and password credentials stored in the repository, and how the code handles sensitive information.
Dependencies and supply chain
Known vulnerabilities in dependencies and the conditions under which they can be exploited in your application.
Security-critical logic
Rules and data flows that need targeted manual review, beyond general pattern matches.
Configuration in the source code
Settings and defaults that can affect exposure. The settings actually used in production are checked separately when that is in scope.
The code review applies to the agreed code version. An installed vulnerable component or a rule match does not automatically mean the system is exploitable. We assess whether the vulnerability can be reached and exploited in your application, and report what remains to be investigated.
Your deliverable
From a code reference
to a concrete fix.
The report helps both the development team and whoever needs to prioritise the security work.
- A readable summaryThe most important results, the questions that remain open, and the limitations of the assessment.
- Technical evidenceCode references, affected components, and a clear distinction between validated findings and candidates.
- Remediation proposalsConcrete recommendations and how we can verify that a fix has had its intended effect.
- A shared walkthroughResults and next steps are reviewed with the people involved, according to the scope of the engagement.
EXAMPLE / ASSESSING A DEPENDENCYA vulnerable version
A vulnerable version
needs investigating.
OBSERVATIONA dependency has a known vulnerability.
NEXT QUESTIONIs the affected function used, and can attacker-controlled data reach it?
ASSESSMENTSeparate the information in the vulnerability advisory from verified impact in the reviewed application.
ILLUSTRATIVE EXAMPLE · NOT A CUSTOMER RESULT
How it works
A clearly bounded engagement.
Set the scope
We agree on repositories, code version, technology choices and security objectives.
Agree on access
Permissions, code handling and the terms for the analysis tools are set before we start.
Analyse and review
AI-driven analysis and automated checks point out areas for targeted review and validation.
Walk through and follow up
You receive results and remediation proposals. A further review or retest is agreed when needed.
Good to know
Before your
first engagement.
When is code review particularly valuable?
Ahead of a launch, for major changes, when taking over a codebase, or when you need an independent assessment of security-critical parts.
Do you read the entire codebase manually?
The scope is set in the engagement. Automated analysis gives breadth and identifies areas for targeted manual review; we describe which parts have actually been reviewed.
Do you change our code?
We review the code without changing it and hand remediation proposals to your team. If we are also to produce or carry out code changes, that needs to be agreed separately.
How does it differ from a pen-test?
Code review examines how the system is built. Pen-test probes the behaviour of a running system. Together they can give a better understanding of both the cause and the practical impact.
Take the next step
What protects
your codebase?
Tell us which technologies you use and what you want reviewed. We will propose a clear scope.