services / source-code-review

Source Code
Security
Review

Manual security review of application source code to identify weaknesses in authentication, authorization, business logic, data handling, cryptography and API implementation — with findings your developers can act on.

ILLUSTRATIVE EXAMPLE — NOT CLIENT CODE
auth.py
db_query.js
crypto.java
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
import hashlib, sqlite3 def login(username, password): conn = sqlite3.connect("users.db") # ⚠ SQL INJECTION — user input unsanitisedCRITICAL query = f"SELECT * FROM users WHERE " f"user='{username}' AND pwd='{password}'" result = conn.execute(query).fetchone() if result: return generate_token(result[0]) def hash_password(pwd): # ⚠ WEAK HASH — MD5 is cryptographically brokenHIGH return hashlib.md5(pwd.encode()).hexdigest() # ✅ FIXED: use parameterised queries + # bcrypt with cost factor ≥ 12
why source review

See the Security Logic

Source code review gives security engineers visibility into implementation details that may be difficult to establish from external testing alone. It can expose flawed authorization decisions, unsafe data flows, insecure cryptography and business-logic weaknesses before or alongside runtime testing.

For SaaS and fintech teams, the review can focus on high-value workflows such as authentication, tenant isolation, payment or transaction logic, privileged operations and API trust boundaries.

vulnerability classes

What We Find

Review scope is tailored to the application and codebase. We combine manual analysis with appropriate automated tooling to investigate security controls, attack paths and high-risk implementation areas.

injection.py / sqli.js CRITICAL
Injection Flaws

SQL, NoSQL, LDAP, OS command, and SSTI injection — tracing unsanitised input from entry point to database or system call, including second-order injection and ORM-level bypasses.

PythonJavaPHPNode.jsGo
crypto_util.java CRITICAL
Cryptography Weaknesses

Broken algorithms (MD5, SHA1, DES, ECB mode), hardcoded IV/keys, predictable random number generation, insecure key storage, and custom crypto implementations that should never exist.

JavaC#PythonKotlin
.env / config.yml CRITICAL
Hardcoded Secrets

API keys, database credentials, JWT signing secrets, cloud access tokens, and private keys hardcoded in source files, config files, build scripts, and git history.

All LanguagesYAMLGit History
auth_middleware.ts HIGH
Authentication & Authorisation

Broken auth logic, missing authorisation checks, JWT algorithm confusion (alg:none), mass assignment, IDOR, privilege escalation paths, and insecure session management.

TypeScriptJavaScriptGoRuby
renderer.js / template.php HIGH
XSS & Template Injection

Reflected, stored, and DOM-based XSS, server-side template injection (SSTI), unsafe innerHTML usage, missing Content-Security-Policy, and dangerous eval() / dangerouslySetInnerHTML patterns.

JavaScriptReactPHPJinja2
file_handler.py HIGH
Insecure File Operations

Path traversal, unsafe deserialization, unrestricted file uploads, XXE in XML parsers, zip slip vulnerabilities, and insecure temporary file handling that enables arbitrary read/write.

PythonJavaPHPC#
how we work

Review Methodology

Manual-first analysis with tooling assist — our engineers read your code, not just run scanners against it.

// PHASE 01

Codebase Intake & Scope

Receive source via secure Git access or encrypted archive. Map technology stack, frameworks, and entry points. Define high-value targets — auth flows, payment logic, admin functions, and API endpoints.

// PHASE 02

Automated SAST Scan

Use appropriate SAST and dependency-analysis tooling for the technology stack to surface candidate findings. Triage and validate those results so automated noise does not become your remediation backlog.

// PHASE 03

Manual Data Flow Analysis

Trace all user-controlled input from source to sink — manually following data through business logic, across service boundaries, through ORMs, and into storage to find what SAST tools miss entirely.

// PHASE 04

Business Logic Review

Review application-specific logic — transaction flows, access control decisions, state machine flaws, race conditions, and workflow bypasses that require understanding the application's intent to identify.

// PHASE 05

Dependency & Supply Chain Audit

Audit third-party dependencies for known CVEs, abandoned packages, typosquatting risks, and overly-permissive library versions. Review npm, Maven, pip, and Gradle lockfiles for supply chain exposure.

// PHASE 06

Annotated Report & Fix Review

Deliver findings as annotated code with line-level references, severity ratings, and exact fix recommendations. Optional: review developer fixes before merge and provide a cleared retest confirmation.

languages & tools

What We Support

Supported languages and frameworks depend on reviewer availability and engagement scope. Confirm your stack during scoping.

🐍
Python
Java
🟨
JavaScript
🔷
TypeScript
🐘
PHP
🦫
Go
💎
Ruby
🦀
Rust
©️
C / C++
🔵
C# / .NET
📱
Swift
🤖
Kotlin
sast & analysis tools
SAST Data-flow analysis Dependency analysis Secret detection Code pattern analysis Manual review Threat modelling Git history review
choose the right assessment

Code Review vs SAST vs Pentest

These approaches answer different security questions. A source-code review focuses on implementation and security logic; SAST scales automated pattern analysis; penetration testing validates behaviour in a running environment.

CapabilitySource Code ReviewSASTPenetration Testing
Reads source codeYesYesUsually no
Automated at scaleOptionalYesOptional
Manual security reasoningStrongLimitedStrong
Business-logic analysisStrongLimitedStrong
Runtime behaviourLimitedNoYes
Best used forImplementation weaknessesPattern discoveryExploitability and runtime risk
scoping

What We Need From You

Repository or source packageProvide the agreed codebase through the access method confirmed during scoping.
Technology contextShare the relevant languages, frameworks, architecture and deployment context.
Security contextThreat models, known concerns, sensitive workflows and existing security controls can help focus the review.
Defined scopeAgree repositories, branches, components, exclusions and review depth before work begins.
reference

Grounded in Secure Code Review Practice

Grey Shield's review approach should be tailored to the application and engagement scope. For background on secure code review, OWASP provides guidance on manual review, automated analysis, architecture, data flow, authentication, authorization, business logic and other code-level security concerns.

Read OWASP Secure Code Review guidance ↗
deliverables

What You Get

findings_report.pdf

Annotated Findings Report

Findings are documented with affected component or code location where appropriate, severity, security impact, evidence, and practical remediation guidance.

exec_summary.pdf

Executive Summary

A non-technical summary of overall code security posture, risk exposure, and top priority fixes — written for engineering leadership and CISOs, not developers.

findings.csv / SARIF

Machine-Readable Output

Machine-readable output can be provided where agreed during scoping. Confirm the required format and integration before engagement.

retest_confirmation.pdf

Retesting

After remediation, Grey Shield can perform a retest to verify that agreed findings have been addressed. Exact retest scope and timing are confirmed during engagement.

debrief_call.cal

Developer Debrief Session

A live walkthrough with your engineering team — explaining attack scenarios for each finding, answering fix questions, and advising on secure coding patterns to prevent recurrence.

nda_protected.lock

NDA & Source Code Protection

Source-code handling, access controls, retention and deletion procedures are agreed before the review. [INFORMATION REQUIRED: publish only the storage and deletion commitments Grey Shield actually follows.]

common questions

Source Review FAQ

What is a source code security review?

It is a security-focused examination of application source code to identify weaknesses in implementation, security controls, data flows and application logic.

Is manual review different from SAST?

Yes. Automated analysis can identify useful patterns and candidate issues, while manual review adds context around business logic, authorization, data flow and application-specific security decisions. OWASP describes the two as complementary approaches.

Can you review APIs and business logic?

Yes, where those components are included in scope. The review can trace API inputs, authorization decisions and business workflows through the relevant implementation.

Should source review replace penetration testing?

No. Source review and runtime testing answer different questions. Using them together can provide stronger coverage of both implementation weaknesses and observable application behaviour.

// ship secure code

Find the Flaws
Before Merge

Send us your repository — we'll review it line by line and return findings your developers can act on immediately. Engagement timing depends on codebase size, technology stack, scope and review depth. Confirm timing during scoping.