Overview
UK software suppliers are increasingly asked for evidence of secure development in public-sector and enterprise procurement. A source code review shows that security is built into your development process, and it finds flaws that black-box testing can miss.
Some vulnerabilities are far easier to find in code than from the outside: subtle authorisation checks, insecure cryptography, unsafe deserialization, hidden debug functionality or hard-coded secrets. A source code security review examines how your application really works.
We combine static application security testing (SAST) with focused manual review of the code that matters most — authentication, authorisation, payment and data-handling logic, input processing and integrations. Tool findings are triaged by experts so your developers see real issues, not thousands of warnings.
Code review pairs especially well with a web or API penetration test (white-box testing), giving the highest assurance for critical applications.
How testing works for UK organisations
- Signed scope and written authorisation before any testing, in line with the Computer Misuse Act 1990
- Testing windows agreed in UK time, including out-of-hours windows for production systems
- Fully remote delivery, with internal and wireless access via VPN or a posted test device, so there are no travel costs
- Reports mapped to ISO 27001, PCI DSS, UK GDPR Article 32 and customer questionnaires, with a fixed price in GBP
What's included
Our approach
- Threat modelIdentify critical components and data flows.
- Automated analysisSAST, secrets and dependency scanning.
- Manual reviewExpert line-by-line review of high-risk code.
- ValidateConfirm exploitability and impact where possible.
- Report & walkthroughFindings with code references and fixes.
What you receive
- Findings with file and line references
- Triaged SAST and SCA results
- Secure coding recommendations
- Developer walkthrough session
- Re-review of fixes
Standards & frameworks
- OWASP ASVS
- OWASP Code Review Guide
- CWE Top 25
- PCI DSS 6.2.3/6.2.4
- NIST SSDF (SP 800-218)
- NCSC penetration testing guidance
Frequently asked questions
Which languages do you review?
Common languages including Java, C#, JavaScript/TypeScript, Python, PHP, Go, Kotlin and Swift. Confirm specific frameworks during scoping.
Do you need access to our full repository?
We need the code in scope and enough context to build or understand it. Access can be provided through a secure, time-limited method.
Is our code kept confidential?
Yes. Code is handled under NDA, stored encrypted and securely deleted after the engagement.
Are you CREST or CHECK accredited?
We don't claim CREST or NCSC CHECK status on this site. Most private-sector tests, including those for ISO 27001, PCI DSS and customer due diligence, don't require either. If a contract, public-sector buyer or regulator specifically requires a CHECK or CREST-accredited provider, tell us at scoping and we'll tell you honestly whether we can meet it. See our CREST and CHECK guide.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.