Code Security · Stat
84%
of security vulnerabilities are introduced at the code level.
Finding them in production costs 6x more.
Book a Free Code Review →
~/homeservicessecure-code-review
03.3 · Secure Code Review

Every line.
Every commit.

We focus deep manual review where the risk lives — authentication, authorization, payments, file handling, crypto — and pair that with SAST, SCA, and AI-assisted triage across the rest of the codebase. The result: the business-logic flaws and insecure-by-design patterns that scanners alone consistently miss.

Coverage
SAST · SCA · Manual
Standard
OWASP ASVS · CWE
Retest
Included
app/auth.py
config.py
payments.py
4 findings
1from flask import Flask, request, session
2import sqlite3, hashlib
3
4def login(username, password):
5 conn = sqlite3.connect("app.db")
6 cursor = conn.cursor()
7 cursor.execute(f"SELECT * FROM users WHERE name='{username}'")
8 user = cursor.fetchone()
9 return user
10
11class Config:
12 # <-- production config
13 DEBUG = False
14 API_KEY = "sk_live_a8f3c92e1d7b4f6a"
15 DB_HOST = "db.internal"
16
17@app.route("/transfer", methods=["POST"])
18def transfer():
19 amount = request.form["amount"]
20 to_acc = request.form["to"]
21 execute_transfer(session["user"], to_acc, amount)
22 return "OK"
23
24def hash_password(pwd):
25 # legacy hashing
26 salt = "static_salt_2019"
27 combined = pwd + salt
28 return hashlib.md5(combined.encode()).hexdigest()
Findings
CRITICALL7
SQL Injection
CWE-89
User input concatenated into raw SQL query. Use parameterized statements.
HIGHL14
Hardcoded Credential
CWE-798
HIGHL21
Missing CSRF Token
CWE-352
MEDIUML28
Weak Cryptography
CWE-327
01 / Engagement Models

Point-in-time. Or every commit.

Choose how deep we go and how often. Many clients start with a snapshot audit and graduate to continuous review.

SNAPSHOT

Pre-Release Audit

// Point-in-time. Deep. Definitive.

You hand us a release branch or a tagged version. We freeze a snapshot, perform exhaustive manual review backed by SAST + SCA, and ship a complete findings report before you push to production.

  • Full codebase audit on a frozen branch
  • Deepest manual review per finding
  • Best fit before major releases / audits
  • Single deliverable, single timeline
CONTINUOUS

CI/CD Integration

// Every PR. Every release.

We integrate into your CI pipeline. Every pull request gets automated SAST + AI triage, with our human team reviewing flagged changes and high-risk areas weekly. Security shifts left without slowing devs down.

  • GitHub / GitLab / Bitbucket native
  • Auto-block PRs with critical findings
  • Weekly human review of hot files
  • Monthly trend & maturity reports
02 / Stack Coverage

Your language. Our specialists.

We don't generalize. Reviewers are matched to your stack so the findings come with idiomatic, framework-aware fixes.

01JavaScript / TypeScript
Node · React · Next · Express · NestJS
02Python
Django · Flask · FastAPI · Celery
03Java / JVM
Spring · Kotlin · Quarkus · Android
04C# / .NET
ASP.NET Core · Blazor · EF Core
Our toolchain · JavaScript / TypeScript
SemgrepESLint SecurityCodeQLSnyk Codenpm auditSonarQube
$ semgrep --config=auto src/
[*] scanning 14,302 LOC · 387 files
[!] 7 critical · 14 high · 22 medium
[~] 89 informational
$
JavaScript / TypeScript-specific checks
Prototype pollution & object injection
XSS (reflected, stored, DOM-based)
SSR data leakage & hydration mismatches
JWT verification & secret handling
npm supply chain & typosquatting
Express middleware ordering & bypass
CSRF, CORS, & security headers
Server-side request forgery (SSRF)
03 / Selected from MITRE CWE Top 25

The weakness
catalogue, in code.

Click any weakness to see what we look for at the source level.

CWE-79
Cross-Site Scripting
CWE-89
SQL Injection
CWE-787
Out-of-Bounds Write
CWE-20
Improper Input Validation
CWE-78
OS Command Injection
CWE-862
Missing Authorization
CWE-352
Cross-Site Request Forgery
CWE-22
Path Traversal
CWE-502
Insecure Deserialization
CWE-798
Hardcoded Credentials
CWE-79 / MITRE

Cross-Site Scripting

Reflected, stored, and DOM-based XSS. We trace every user-controlled input to every sink, including framework-specific bypasses.

Observed in our engagementsCRITICAL · 88%
Potential Impact
  • Session cookie theft leading to full account takeover
  • Credential phishing via injected login UI in trusted page
  • Keylogging injected into payment or admin forms
  • Stored payload escalates to admin panel compromise
04 / Methodology

Four layers. Zero blind spots.

Scanners catch the known. AI surfaces the suspicious. Humans find what matters.

SAST

Static scanners

Automated tools scan every line of code against known vulnerability patterns at machine speed. This layer catches common issues reliably and consistently across every release.

  • Known vulnerabilities found instantly
  • Consistent coverage across every release
  • No extra setup or effort from your dev team
SCA

Dependency analysis

Every third-party library your project depends on is checked against live vulnerability databases. Outdated, exploited, and typosquatted packages are all flagged with clear fixes.

  • CVEs in your dependencies exposed early
  • Supply chain risks surfaced and explained
  • Clear fix recommendations per package
AI

AI-assisted triage

Our AI reviews scanner output to cut noise, prioritize real issues, and trace how data moves through your code. Your developers only see findings that actually need attention.

  • Far fewer false positives to investigate
  • Suspicious data flows highlighted automatically
  • Findings ranked by real business impact
MANUAL

Expert manual review

Senior application security engineers read the high-risk paths directly — authentication, authorization, payments, cryptographic operations, file handling, custom business logic. Findings include the exact line, the data flow that reaches it, and a concrete patch proposal.

  • Logic flaws scanners cannot detect
  • Design-level risks explained in plain terms
  • Every critical finding verified before delivery
05 / Compliance Alignment

Mapped to the standards your auditors reference.

OWASP ASVS
Verification Std
OWASP SAMM
Maturity Model
CWE Top 25
MITRE
NIST SSDF
SP 800-218
ISO 27034
App Security
PCI DSS 6.5
Secure Coding
GDPR
Art. 25 · Privacy by Design
SOC 2
CC8.1
06 / Engagement Process

From git clone to attestation.

Click a phase to see what happens and what you'll see in our shared workspace.

01

Repo Handover & Scope

Day 0
A short scoping call locks the repo, language stack, branch, and any sensitive paths to exclude. We get read-only access, never write.
02

Recon & Architecture

Day 1
We map the codebase: entry points, trust boundaries, third-party libs, and the data-flow paths an attacker would target.
03

Automated Sweep

Day 2
Semgrep, CodeQL, Snyk, and custom rule packs run against the codebase. AI agents triage and suppress likely false positives.
04

Manual Deep Review

Day 3–N
Senior engineers read the high-risk files by hand: auth, payments, file uploads, business logic. This is where the real findings come from.
05

Report & Retest

After fix
Per-finding report with code snippets, exploitation impact, and a proposed patch. Free retest validates every fix in the next build.
~/audit/01● Day 0
>> read access provisioned · org/client-app
>> language: TypeScript · framework: Next 14
>> branch frozen · semicolon-audit-v4.2
$
07 / Deliverables

What lands on your desk.

Findings your engineers can act on: line-numbered, framework-aware, patch-ready.

code-review-report.pdf
v1.0 · 64 pages · CWE + ASVS mapped
CONFIDENTIAL
Severity Distribution
Critical
5
High
11
Medium
14
Low
6
  • Executive summary (non-technical, 1-page)
  • Per-finding: file · line · CWE · CVSS · code snippet
  • Proposed patch (diff-ready) for every issue
  • Architectural recommendations & maturity scoring

Free Retest, Included

One full retest within 60 days of report delivery, included. We re-validate every finding on the rebuilt branch; a second pass is available if first-pass remediation is partial.

Patch-Ready Diffs

We don't just flag what's broken. We give you the fix as a unified diff your engineers can apply or PR.

Dependency Report

A separate SCA report covers third-party CVEs, transitive risks, and an upgrade path prioritized by exposure.

Free · 45 min · No pressure

Start with a free consultation.

A 45-minute call with a Semicolon cybersecurity expert. We’ll learn about your company, your services, and your cybersecurity needs, then explain exactly what an engagement with Semicolon would look like. No deck, no sales rep, no commitment.

  • Talk to the actual expert
  • Walk through your architecture & risks
  • Get a tailored scoping proposal
SC
Semicolon Security
Online now
Replies in < 24h
Type your question...
Let's talk →