Secure Code Review
Quoted on scope, fixed price. Includes the Vexil platform and a hand-verified retest.
Teams who have had us test their systems
- Selip & Stylianou, LLP
What this covers
Automated SAST tools generate noise. Our secure code review combines automated scanning with expert manual analysis - we find the injection flaws, crypto mistakes, and auth bypasses that tools miss, and we don't waste your time with false positives. We review your codebase line-by-line for the vulnerabilities that matter: injection, broken authentication, sensitive data exposure, XXE, access control gaps, insecure deserialization, and cryptographic weaknesses. Every finding is manually validated and includes a fix recommendation specific to your framework and language. You get a findings report organized by severity and module, a secure coding guide tailored to your stack, and direct access to the reviewer for questions during remediation.
- Ship code with confidence - every critical module reviewed before deployment
- Catch logic flaws, crypto mistakes, and auth gaps that SAST tools miss
- Get fix recommendations in your language and framework
- Build a secure coding culture with guidelines tailored to your stack
Why a tool is not a review
“We already run a SAST tool.”
For part of it. But a tool checks whether code is written safely, not whether the rule it enforces is the right one. Only a person reads the intent and finds the check that was never written.
SAST tool
Finds what is there
- Untrusted input reaching a dangerous call
- Dependencies with known advisories
- Secrets committed to the repository
- Unsafe functions and weak crypto calls
- Complexity and style warnings
Fast, and worth running.
Tester
Finds what is broken
- An authorisation check that is missing, not wrong
- Two requests racing on the same balance
- Server logic trusting a value the client set
- A fix applied to one of the three call sites
- A helper used safely in one place and not another
This is where the real risk is.
We run both, in that order. Tool output is kept separate from what a tester wrote, so you always know which is which.
Book a Free ConsultationMethodology
How the work is done
Repeatable, documented, and tracked as coverage inside the platform so you can see what has been looked at.
- 01
Scope & Access
Define review scope (full codebase, critical modules, or PR-based). Get read-only repo access. Agree on languages and frameworks in scope.
- 02
Automated + Manual Review
Run SAST for broad coverage, then manual line-by-line review of every finding plus critical paths (auth, payments, user data handling).
- 03
Report & Pairing
Findings report with validated vulnerabilities, severity, and code-level fixes. Optional: pair with your devs to walk through fixes.
- 04
Re-review
After fixes, re-review changed code to confirm resolution. Updated report for audit trail.
Why it matters
What you get out of it
Framework-Specific
Reviews tailored to your stack - Express, Django, Rails, Spring Boot, Laravel, Next.js, Go, and more. Fixes in your language, not generic advice.
Validated by hand before you see it
Every finding is manually verified before it reaches your report. We don't ship scanner output - we ship validated vulnerabilities.
Architecture-Level Findings
Beyond code-level bugs, we identify architectural weaknesses: missing auth layers, trust boundary violations, and insecure data flows.
Secrets & Config Audit
Hardcoded API keys, weak crypto defaults, debug mode in production, and dangerous framework settings.
What you receive
Delivered in the platform as the work happens, and exportable as a document whenever you need one.
- Findings report - every vulnerability with file path, line number, severity, and fix code
- Secure coding guide - framework and language-specific best practices for your team
- Secrets audit - hardcoded credentials, API keys, and tokens found in the codebase
- Dependency check - known vulnerabilities in third-party packages and libraries
Standards we test against
Coverage is tracked against these inside the platform, so “what did you actually check” has an answer.
- OWASP Top 10
- CWE Top 25
- SANS Top 25
- PCI-DSS
- NIST SSDF
The anatomy of a finding
This is one finding.
Not a report. One finding, with every field it carries and why each field is there. Yours will look like this.
Vexil · Finding
Published- Titlewhat it is, in your engineers’ words
One handler is missing the ownership check the other three have.
- Affected assetthe file and the line, not “the repository”
The check exists on read, update and delete - not on export.
- orders/views.py:214
- Severitycomputed from the vector, never chosen by hand
- high
- CVSS 3.1 · 8.1
- AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CWE-862
- Evidencethe request, the response and screenshots, attached to the finding
The queryset is filtered by identifier alone, where its neighbours filter by identifier and owner.
- Order.objects.get(pk=pk)
- Impactwhat it costs you, not what the CVE says
A tool cannot find this: nothing is unsafe, a line is absent. The export path returns any customer’s order to any signed-in user.
- Remediationfor your stack, not “apply vendor patches”
Scope the lookup to the requesting user as the sibling handlers do, and add the case to the test suite so the fourth path cannot drift again.
- Retesta tester’s verdict, not your self-assessment
Retest passed. Verified by hand, recorded with the date and the tester.
This is the format, not a client’s work - it is written against the demonstration environment we run for the purpose, and a real finding also carries screenshots of the issue alongside the request and response. We don’t publish client findings, redacted or otherwise. If you want to see a real one, email us and we’ll send a redacted sample.
Pricing
What changes the price
Every engagement is quoted on scope rather than hours. These are the four things that move it, and they are what we work through on the call.
Codebase
Repositories and rough size
Languages
How many stacks
Depth
Whole codebase or critical paths
Access
Source, build and dependencies
Delivered on the Vexil platform
Each finding carries the file and the line, so it reads like a pull request comment rather than a PDF your team has to translate back into code.
See the platformFAQ
Questions about secure code review
How is this different from running SonarQube or Snyk?
SAST tools catch syntax-level issues (SQL injection patterns, hardcoded passwords, known CVEs in dependencies). They miss logic flaws, auth bypasses, business logic issues, and architectural weaknesses. They also produce high false-positive rates. Our manual review catches what tools miss and removes false positives so your dev team only works on real issues. The two are complementary rather than alternatives: SAST belongs in CI/CD to catch regressions, a review goes deeper than any tool can.
Do you need access to our private repository?
Yes, read-only access. We sign an NDA as part of every engagement. Code is stored on encrypted, air-gapped review workstations and deleted within 30 days of engagement completion. We can also review on-site or via a customer-provided VDI if required.
What languages and frameworks do you cover?
JavaScript/TypeScript (Node.js, Next.js, Express, NestJS), Python (Django, Flask, FastAPI), Java (Spring Boot, Micronaut), Go, Ruby (Rails), PHP (Laravel, Symfony), C# (.NET), Kotlin, Swift, Rust, and more. If your stack isn't listed, ask - we likely have a reviewer who knows it.
Scope your secure code review engagement.
Thirty minutes on a call and you have a fixed price, a testing date and a walkthrough of the platform against your own scope.