Secure code review
A careful read of the code you depend on
Scanners find the patterns someone already wrote a rule for. The expensive problems are the ones specific to your application, and finding those still means a person reading the code with your architecture in their head.
What we read
Eight areas, in priority order
Authentication and sessions
Token lifetime, refresh handling, revocation, and what actually happens when a user logs out everywhere.
Authorisation
Whether every data path checks that this user may touch this record. Almost all real breaches live here.
Input handling
Injection into queries, commands, templates and anything that renders user text back to a browser.
Secrets and configuration
Where keys live, who can read them, what is baked into images and what leaks to the client.
Third-party calls
Outbound requests, webhook verification, and SSRF through anything that fetches a URL a user supplied.
Dependencies
Known vulnerabilities, abandoned packages, and the ones pulled in for a single helper function.
Data handling
What is logged, what is retained, what is encrypted and what quietly ends up in an analytics payload.
Multi-tenancy
If you serve multiple customers, whether tenant isolation holds everywhere or only in the places someone remembered.
How we report
Findings you can act on the same day
- Every finding carries a file, a line and a one-paragraph explanation of the impact in business terms.
- Anything rated high or critical comes with a demonstration, so you are not arguing with a scanner's opinion.
- A suggested fix for each, written so a developer can start without researching first.
- Low-severity noise is summarised, not padded into a 400-item appendix.
- A call with your engineers to walk through it, because a document alone rarely changes anything.
From
$3,000fixed scope
A focused review of one service or critical path. Full applications are quoted after we see the repository. Remediation separate.
Book a scoping callFAQ
Common questions
How is this different from the AI code audit?
Same discipline, different starting point. The AI audit assumes a young codebase written largely by assistants and looks for the specific patterns those tools produce. This is for an established codebase with a real history, where the interesting problems are architectural: trust boundaries that moved, permissions that accumulated, and code nobody has read in two years.
Do you need production access?
No. Read-only repository access and a walkthrough. We do not want production credentials and we do not want customer data, because holding either makes us a risk to you.
What languages and stacks?
JavaScript and TypeScript, Python, Go, PHP and the common web frameworks around them. If you are on something outside that, say so before you pay us, and we will tell you honestly whether we are the right reviewers.
What does it cost?
From 3,000 USD for a focused review of a service or a critical path, and more for a full application, agreed as a fixed number after we have seen the repository size and shape. Remediation is quoted separately.
Let's talk
Tell us what you're building.
Get a free 30-minute strategy call. You'll leave with a clear plan, a realistic estimate and our honest opinion — whether or not you work with us.
- Email usmail@voliom.com