Source Code Security Review

2 Million Customer Records Leaked Through SQL Injection

A fintech company lost their license and paid €800,000 GDPR fine. Attackers exploited SQL injection in login form - a vulnerability any SAST tool would detect in 5 minutes. Nobody reviewed the code before deployment.

Without source code security review:

• SQL injection, XSS, path traversal reach production
• Fixing in production costs 10x more than during development
• Risk of data leak, GDPR fines, reputation loss
• Developers repeat same mistakes in future projects

Automation + Expertise = We Find What Matters

SAST tools find obvious bugs. Experts find business logic flaws no tool can detect. We combine both approaches.

What you get:

• Report with OWASP Top 10 vulnerabilities (SQL injection, XSS, broken auth…)
• Business logic analysis (broken access control, business logic flaws)
• Severity for each vulnerability (Critical, High, Medium, Low)
• Example fix code for each vulnerability
• Mapping to CWE/CVE and standards (OWASP, SANS Top 25)
• Developer support for fixes and verification

Who Is It For?

This service is for you if:

• You’re deploying new application and want to ensure it’s secure
• You need to meet PCI DSS, ISO 27001, SOC 2 requirements
• You inherited code from external team and want to know what’s there
• You experienced incident and want to check entire codebase
• You’re building application handling sensitive data (finance, health, PII)

What Vulnerabilities We Detect

OWASP Top 10

• A01 - Broken Access Control - unauthorized access to functions
• A02 - Cryptographic Failures - weak encryption, hardcoded credentials
• A03 - Injection - SQL injection, command injection, LDAP injection
• A04 - Insecure Design - business logic flaws
• A05 - Security Misconfiguration - default passwords, unnecessary features
• A06 - Vulnerable Components - outdated libraries with CVEs
• A07 - Auth Failures - authentication and session management errors
• A08 - Data Integrity Failures - missing input validation
• A09 - Logging Failures - missing logging of critical events
• A10 - SSRF - Server-Side Request Forgery

Business Logic Flaws

• Race conditions in financial transactions
• Authorization mechanism bypasses
• Discount/price calculation errors
• Workflow and business process manipulation

Supported Technologies

We work with most popular languages and frameworks:

• Backend: Java/Spring, .NET/C#, Python/Django, Node.js, PHP
• Frontend: React, Angular, Vue.js
• Mobile: Swift/iOS, Kotlin/Android, React Native
• Other: Go, Ruby, Rust

Example Vulnerabilities We Find

SQL Injection in Login

Vulnerable code (Java):

String query = "SELECT * FROM users WHERE username = '"
    + username + "' AND password = '" + password + "'";

Fix:

PreparedStatement stmt = conn.prepareStatement(
    "SELECT * FROM users WHERE username = ? AND password = ?");
stmt.setString(1, username);
stmt.setString(2, password);

Hardcoded API Key

Vulnerable code (Python):

API_KEY = "sk_live_51ABC..."  # Production key!
stripe.api_key = API_KEY

Fix:

import os
stripe.api_key = os.environ.get('STRIPE_API_KEY')

XSS in Template

Vulnerable code (JavaScript/React):

<div dangerouslySetInnerHTML={{__html: userInput}} />

Fix:

import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(userInput)}} />

Broken Access Control

Vulnerable code (Node.js):

app.get('/api/users/:id/profile', (req, res) => {
    const user = await User.findById(req.params.id);
    res.json(user);  // No check if requester can see this user!
});

Fix:

app.get('/api/users/:id/profile', (req, res) => {
    if (req.user.id !== req.params.id && !req.user.isAdmin) {
        return res.status(403).json({error: 'Forbidden'});
    }
    const user = await User.findById(req.params.id);
    res.json(user);
});

Tools We Use

SAST (Static Analysis)

• SonarQube - multi-language scanner
• Checkmarx - enterprise SAST
• Semgrep - pattern-based analysis
• Snyk Code - real-time scanning
• CodeQL - semantic code analysis

Dependency Analysis

• OWASP Dependency-Check - CVE scanning
• Snyk - open source vulnerabilities
• npm audit / pip audit - package vulnerabilities

Manual Review

• IDE with security plugins
• Custom scripts for pattern detection
• Expert knowledge of common vulnerability patterns

Deliverables

Technical Report

For each vulnerability:

• Description - what it is and why it’s a problem
• Severity - Critical/High/Medium/Low (CVSS score)
• Location - file, line number, function
• Proof of Concept - how to exploit
• Fix code - specific example how to remediate
• References - CWE, OWASP, CVE links

Executive Summary

• Top 10 findings
• Overall security posture
• Risk assessment
• Compliance implications
• Recommended remediation timeline

Standards and Compliance

Source code review supports compliance with the requirements that increasingly mandate secure software development:

• PCI DSS (req. 6.2, 6.3) — secure development and review of application code
• NIS2 (art. 21) — security across the entire software supply chain
• ISO 27001 (A.8.25–A.8.28) — secure development life cycle and secure coding
• OWASP SAMM / ASVS — maturity and verification frameworks for application security
• SANS / CWE Top 25 — the most dangerous classes of software weaknesses

A code review works best as one element of a broader process. We combine it with penetration testing, IT vulnerability management, threat modeling, and security audits.

Related Glossary Terms

Learn more about key concepts related to this service:

• SAST
• DAST
• SCA
• SQL Injection
• DevSecOps
• SDLC
• Access Control
• CVE
• API