Application and code security
Security review for applications and codeIncluding software written with AI tools.
We review web apps, APIs and cloud setup for weaknesses in the code, the configuration and the business logic.
What we test
What the assessment covers
- 01
Access control
Can one user reach another user’s data or functions?
- 02
Secrets and configuration
Keys, tokens and settings that are exposed or too open.
- 03
Input handling
Injection, cross site scripting and unsafe file handling.
- 04
Authentication
Login, sessions, password reset and admin areas.
- 05
Business logic
Flows that can be abused even when each step looks correct.
- 06
Dependencies and cloud setup
Outdated packages and permissive infrastructure settings.
Scope
What we assess
- Web applications and APIs
- Cloud and back end configuration
- Code review of internal or third party work
- Apps built with AI coding tools
Exclusions
What stays out unless agreed
- Systems outside the agreed scope
- Testing on production data unless agreed in writing
- Formal compliance certification
Method
How findings are produced
- 1
Scope
We agree what is tested, the access we need and what is out of bounds.
- 2
Test
We test the running system and review code, configuration and dependencies.
- 3
Validate
We confirm each finding is real and rank it by risk.
- 4
Fix and retest
We fix what we can with you, then check every fix.
The report states who performed the review and what it covered. An assessment of another vendor’s system is described as such. No assessment can promise complete protection.
