Secure code review

A secure code review is a manual security audit of your source code that finds vulnerabilities at their root, including issues a black-box test cannot reach. Mr Cyber reviews authentication, access control, input handling, cryptography, secrets and dependencies against OWASP ASVS, at a fixed price, with fix guidance your developers can apply line by line.

Fixed price from €2,900 · 3 test days · retest included

See my fixed price

Prefer to talk first? Book a call

One line in a pull request builds a database query from raw user input.

3–10 review days3 review days in the starting price
OWASP ASVS+ 4 more standards
Report + debriefwithin 5 business days
Free retestwithin 60 days

Who it’s for

SaaS companies whose customers ask for evidence of secure development
Teams before a major release, a rewrite or an acquisition due diligence
Products where a pentest alone cannot reach all logic
Teams preparing for ISO 27001, SOC 2 or NIS2 secure development controls

What we test

Authentication & access control

Login, sessions and password handling
Role and permission checks on every route
Separation between tenants and customers

Input & output handling

Validation of input from users and other systems
Database queries and file handling
Output encoding and templates

Cryptography & secrets

Use of encryption and hashing
Keys, tokens and passwords in code and configuration
Handling of personal data

Dependencies & build

Third-party libraries with known vulnerabilities
Security settings in frameworks
Build and deployment configuration, on request

Logging & errors

Error handling and information leaks
Security-relevant logging

See my fixed price

Prefer to talk first? Book a call

Also covered. In the same test, or as an engagement of its own.

CI/CD & supply chain

The path from commit to production. We review who can push and approve, what a pull request can change in the pipeline, where deployment secrets live, how runners are isolated and which third-party actions and packages you trust. The OWASP Top 10 CI/CD Security Risks serve as the checklist.

No surcharge Add to my request

Smart contract audit (Solidity / Web3)

Manual review of your Solidity contracts against one agreed commit: access control and roles, handling of funds, upgrades and admin functions, external calls and oracles. The OWASP Smart Contract Top 10 serves as the checklist. No audit can guarantee safety, and the report names the exact commit reviewed. Offered as a separate engagement.

Separate engagement, from €4,700 · 5 test days Add to my request

No extra fee for the topic itself. If it needs more test days, the quote shows them upfront.

How we review your code. Five phases, one tester.

The same senior tester from first scope to retest.

review days in the starting price: 3
business days to the report: 5
days for the free retest: 60

Typically 3–10 review days, depending on the size of the codebase and the languages in scope.

Phase 1

Scope & start date

Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

You pick the date
Phase 2

Code mapping

Architecture, entry points and trust boundaries charted.

Review day 1
Phase 3

Security-critical code review

Logins, input handling, crypto and secrets, line by line.

From review day 2
Phase 4

Report & debrief

Audit-ready report and ticket file, then a call.

Within 5 business days
Phase 5

Free retest

Your fixes tested again and confirmed in writing.

Within 60 days

Methodology & standards

OWASP ASVS
OWASP Code Review Guide
OWASP Top 10
CWE Top 25
CVSS 3.1

How we review code

We start with your architecture: which parts handle logins, permissions, payments and personal data. It is a tool-assisted review focused on security-critical code (authentication, input handling, cryptography, data access): these parts get a line-by-line review, the rest a targeted one. The OWASP Application Security Verification Standard (ASVS) serves as the checklist.

Fixes your developers can apply

Every finding names the file and line, explains why it is a problem and suggests a fix in the style of your codebase.

Combined with a pentest

Code review and pentest work well together. With source access during a pentest, findings are confirmed faster and the root cause is clear.

Critical findings don’t wait for the report

If we find something critical during the review, you hear from us the same day.

What you get

Executive summary for management and auditors
Every finding with file, line, explanation and a suggested fix
CVSS 3.1 scoring plus business-risk rating and remediation priorities
Debrief call with your developers
Free review of your fixes and updated report

Always included

Free retest within 60 days
Debrief call with your team
NDA, DPA and testing authorisation with the offer
Critical findings reported the same day
Testing stops at any time on your call
Audit-ready report (PDF)
Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42

See my fixed price See the report

Pentest report · Admin & Söhne GmbH · MC-2026-026

Risk: High CVSS 3.1 · 7.5 Open · retest included

Parcel tracking builds its database query from raw input

Repository shop-backend · TrackingController.php (parcel tracking, no login)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

A recent change to the parcel tracking form pastes the visitor’s tracking number directly into the database query. The form needs no login, so any visitor can extend the query and read tables they should never see. The database account behind it can only read, which is why nothing can be changed.

Steps to reproduce

Open the parcel tracking form on the shop page, without logging in.
Follow the code: the entered tracking number goes straight into the database query.
In the test system, confirm that a specially formed tracking number returns rows from the customer table.

TrackingController.php:41
  $sql = "SELECT … WHERE tracking_no = '" . $input . "'";
Database account: shop_read (read-only)

Business impact

Anyone on the internet can copy all customers’ addresses and order histories: a GDPR breach, reportable within 72 hours. Found in the code before release, it costs one line to fix.

Remediation

Use a parameterised query for the tracking number, and check that it matches the expected format. Search the code for other queries built from input. Add an automatic code check to the build that flags such queries.

OWASP Top 10 2021: A03 Injection · CWE-89 (SQL Injection) · OWASP ASVS 4.0 V5.3

Fixed price from

€2,900

3 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does a secure code review cost?

Fixed prices start at €2,900 for up to 50,000 lines of your own code (no tests, generated, vendored or lock files). Larger codebases or three or more languages add effort. The review is tool-assisted and focused on security-critical code (authentication, input handling, cryptography, data access), which keeps the price down. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.

How do you get access to our code?

Read-only access to the repository, or an export. The code is used only for the review and is deleted within 30 days after the project. The NDA, DPA and testing authorisation come with the written offer.

Do we need to review the whole codebase?

Rarely. We help you choose the parts that matter most, such as authentication, payment or data export, so the budget goes where the risk is.

What is the difference to a code scanner (SAST)?

A scanner finds known patterns and many false alarms. A reviewer understands your logic and finds flaws like missing permission checks, which scanners usually miss. Scanner results can be reviewed as part of the job.

Code review or pentest?

They complement each other. A pentest shows what is exploitable from the outside. A code review finds the root cause and issues the pentest cannot reach. Combined, they give the most complete picture.

NIS2 & Compliance