OUR SERVICES
Source code security review
Upload a source-only ZIP for a free automated review, or ask us to review agreed parts of your codebase by hand. We look for exposed secrets, unsafe patterns and dependencies with published advisories.
Security problems in code are cheaper to fix before release than after an incident. Our automated review reads your source without installing or running it and flags potential credentials, disabled certificate checks, dynamic code execution, shell execution, unsafe deserialization, raw HTML insertion and debug settings. Python files also get syntax-tree checks for dynamically built database queries.
You can opt in to a dependency check that compares exact package versions with published advisories from OSV. Only package names and versions are sent. A version match means the advisory deserves a look, not that your application is exploitable.
Automated matches are review candidates. They can include tests, comments and safe code, so each one needs context. In a manual code review we read the agreed areas of your application, follow how data moves through it, and report issues that pattern matching cannot find, such as authorisation and business logic flaws.
Uploaded archives are inspected in memory and discarded after the request. Do not upload live credentials, and only submit code you own or are authorised to share.
What we can help with
- Exposed credentials and private keys
- Unsafe code patterns with file and line references
- Optional dependency advisory lookup
- Manual review of agreed areas
- Prioritised findings with suggested fixes
Questions about scope, costs, or getting started? Read our project FAQs.