Overview
Source code review is one of the audit types listed in CERT-In's 2025 audit guidelines, and it is a common request before a major release, a funding round or an enterprise customer's due diligence. We read the code paths that handle money, identity and personal data by hand, with tooling to cover breadth, and point every finding to the file and line that needs to change, along with a fix that suits your framework.
A penetration test shows what an attacker reaches from outside; a code review shows why. By reading the source we can follow a piece of untrusted input from the moment it enters the application to the point where it reaches a query, a command, a file path or a template, and judge whether every step in between actually defends against abuse. That path is often invisible from the outside, especially where a flaw needs a specific state to trigger.
We combine static analysis tooling with manual reading so the hours land where they matter. Tools flag candidate issues at scale; our reviewers confirm which are real, discard the noise, and find the problems tools cannot reason about: broken authorisation logic, unsafe deserialisation, secrets committed to the repository, weak or home-grown cryptography, and dependencies with known vulnerabilities. We focus on the authentication, authorisation and data-handling code first, because that is where a single mistake does the most harm.
Every finding points to the exact file and line, explains the flawed logic, and recommends a concrete code change, not a generic principle. Where a pattern repeats across the codebase we say so, so your team can fix the class rather than the instance. The review pairs well with a penetration test: one confirms exploitability, the other explains root cause and catches what external testing never reaches.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Repository intakeWe take read access to the code and a short walkthrough of its architecture.
- Automated passStatic analysis flags candidate issues across the whole codebase at scale.
- Manual reviewReviewers trace data flows and read security-critical logic by hand.
- ValidationCandidate issues are confirmed, de-duplicated and ranked by real impact.
- Report & debriefWe deliver findings by file and line and brief your developers on fixes.
What you receive
- Findings mapped to exact file and line references
- Root-cause explanation for each issue
- Concrete code-level remediation, not generic advice
- Notes on recurring patterns to fix as a class
- Free re-review of fixed code on request
Standards & frameworks
- OWASP ASVS
- OWASP Top 10
- OWASP WSTG
- SANS CWE Top 25
- NIST SP 800-115
- CWE
- CVSS v4.0
- DPDP Act 2023
- RBI IT Governance Direction 2023
Frequently asked questions
Is this just running a SAST tool?
No. We run static analysis to cover breadth, but the value is in the manual reading that follows: confirming real issues, discarding false positives, and finding logic flaws no tool understands. You receive reviewed findings, not an unfiltered scanner export.
How much code can you review in an engagement?
Effort scales with size and complexity, so we agree a focus up front, usually the authentication, authorisation and data-handling paths and any recently changed areas. For a very large codebase we prioritise the highest-risk components rather than skim everything shallowly.
Do you need to build or run our code?
Usually read access to the repository is enough, since the review is static. Being able to build or run the application helps us confirm a few findings, so we welcome a working environment where you can provide one, but it is not essential.
Do you quote in rupees, and is GST extra?
Yes to both. Proposals are fixed-price in INR, and 18% GST is added on the invoice. The figure covers testing, the report, a debrief call and a retest of the findings you fix.
Can this report go to our RBI or SEBI auditor?
Reports show scope, dates, method, CVSS-rated findings and closure status, which is what auditors normally look for. If a regulator or contract insists on a CERT-In empanelled auditor, note that we do not claim empanelment; raise it when we scope the work and you will get a clear yes or no on whether we can meet it.