Code

Code analysis and secure code review

Static review, dependency and secret scanning of one repository up to 50,000 lines, with human triage and fix guidance. From $350 per scan.

Code analysis finds the flaws that only show in source: hard-coded secrets, vulnerable dependencies, unsafe input handling and insecure defaults. The scan is static, so nothing is executed and nothing touches production.

Method

  1. Scope: repository, branch and ownership confirmed in writing.
  2. Automated analysis: static rules, dependency advisories, secret patterns.
  3. Manual review of every Critical and High result to remove false positives.
  4. Report and consultation, then a retest of fixed items.

Included at the starting price

  • Static analysis of one repository up to 50,000 lines (larger repositories are quoted)
  • Dependency and known-vulnerability scanning against current advisories
  • Secret and credential scanning across history
  • Human triage of every Critical and High result, with severity, affected file and line, and a specific fix

Not included

  • Runtime or dynamic testing of the deployed application
  • Infrastructure-as-code review (quoted separately)
  • Fix implementation

Deliverable

Technical report (PDF) with severity-ranked findings, plus an executive summary and a results consultation call.

Questions

Which languages do you cover?

Any language. Static analysis, dependency and secret scanning run against the repository as supplied, and the human triage of Critical and High results is language-independent.

How long does a code analysis take?

48 hours from repository access for repositories up to 50,000 lines. Larger codebases take up to 5 business days and are confirmed before work starts.

Do you need write access to the repository?

No. Read-only access to a branch or a tagged archive is enough. Access is confirmed and logged before the scan runs.

Request an assessment

Tell us what you need tested.

We reply within one business day with a scoped proposal. No scan runs until ownership of the target is confirmed.

  • Web, app and API testing
  • Code analysis and server scans
  • Ongoing patch management
  • Post-quantum readiness review

Enter your name.

Enter a valid email address.

Hostnames can wait for the scoping call.

Request sent. We'll reply within one business day with a scoped proposal.