Source code review
Line level security review that combines GARUDX analysis with expert manual reading.
- Input handling and injection sinks
- Authentication and authorisation logic
- Cryptography and secret management
- Insecure dependencies
- Error handling and logging
- Business logic and data flow
The business problem
Some vulnerabilities are invisible from the outside. Weak cryptography, unsafe data flows and hidden backdoors only show up in the code itself.
Scope of assessment
Scope is agreed with you before any work starts. A typical engagement covers the areas below, adjusted to your environment, your priorities and any testing windows you need.
- Input handling and injection sinks
- Authentication and authorisation logic
- Cryptography and secret management
- Insecure dependencies
- Error handling and logging
- Business logic and data flow
Methodology
Automated coverage first, then manual work where it counts. Every finding is validated before it reaches you.
- Discovery
- Reconnaissance
- Threat modeling
- Scanning
- Manual testing
- Exploitation
- Validation
- Risk analysis
- Reporting
- Remediation support
- Retesting
Typical engagement timeline
Depends on lines of code and languages. Confirmed at scoping.
Standards and references
- OWASP Top 10
- OWASP ASVS
- CWE Top 25
- OWASP Code Review Guide
Tools and techniques
- GARUDX source code analysis
- Manual data flow tracing
- Dependency analysis
- Secret detection
What you receive.
- Findings mapped to CWE and OWASP
- File and line references
- Secure code examples for each fix
- PDF, Word and Excel reports
- Developer walkthrough
Benefits
- Know which weaknesses are real and exploitable
- Fix in the order that reduces the most risk
- Give leadership and auditors clear evidence
- Confirm fixes work through retesting
Source code review report
Executive summary
Each finding: evidence, impact, steps to reproduce, fix.
Why us.
- Experienced security professionalsAssessments are led by practitioners who do this work every day.
- Offensive security expertiseWe think like attackers because that is our core discipline.
- Manual validationEvery finding is confirmed by a person before it reaches your report.
- Enterprise focused assessmentsScoping, communication and reporting that fit large organisations.
- Transparent reportingEvidence, reproduction steps and plain language. No padding.
- Actionable remediationSpecific fixes your developers and administrators can apply.
Questions.
How long does a penetration test take?
It depends on scope. A single application often takes one to three weeks, and larger estates take longer. We confirm the timeline during scoping, before work begins.
What does a security assessment report contain?
An executive summary, scope and methodology, each finding with severity, evidence and reproduction steps, the business risk, and specific remediation guidance.
Do you provide remediation support?
Yes. We walk your developers and administrators through each finding and stay available for questions while they fix it.
Do you provide retesting?
Yes. Once fixes are in place we retest the affected items and update the report with the verified status.
What security standards do you follow?
Our work references the OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, OWASP MASVS, CWE Top 25, PTES, NIST guidance and MITRE ATT&CK, as applicable to the engagement.