Vorpsel / Services / Assurance
Application security review
We review the applications and APIs you build from the inside: the design, the code and the way they are built and deployed. Findings come with the line of code, the risk and the fix, written for the developers who will make it.
At a glance
- For web applications, APIs and mobile back ends you develop
- Method threat modeling, architecture and code review
- Reference OWASP ASVS and the OWASP Top 10
- Retest included, to confirm each fix
Problems are cheaper to fix where they are written
Automated scanners find a part of the problems, and a firewall in front of the application blocks a part of the attacks. Flaws in business logic and authorization, such as one customer being able to read another customer's data, are found by reading the design and the code.
With access to the source, a review finds more in less time than testing from the outside, and each finding points to the exact place to change.
Common findings
One customer sees another's data
Missing checks that let a user read or change records of another customer by changing an identifier.
APIs without authorization
Endpoints that check who you are but not what you are allowed to do.
Secrets in the code
Passwords, keys and tokens committed to the repository or shipped to the browser.
Injection
Input from outside that reaches a database query, a command or a template without being handled safely.
Unsafe file handling
Uploads and downloads that let someone store or read files they should not.
Outdated libraries
Third-party components with known vulnerabilities and an available fix.
What the review covers
Threat modeling
With your architects and developers, we draw how data flows through the system and ask, at each step, what could go wrong and what stops it.
- A diagram of the system, its trust boundaries and its sensitive data
- The threats to each part, ranked, with the controls that address them
Architecture review
We look at the decisions that are expensive to change later: how users and services authenticate, how tenants are separated, how secrets are kept and how data is encrypted.
- Authentication, sessions and access control
- Separation between customers in multi-tenant systems
- Secrets, keys and encryption of data at rest and in transit
Secure code review
We combine automated analysis with manual reading of the parts that matter most: authentication, authorization, payments, file handling and anything that takes input from outside.
- Business logic and authorization flaws that tools do not see
- Injection, unsafe deserialization and server-side request forgery
- Vulnerable and outdated third-party libraries
Build and delivery pipeline
We review how code reaches production, because a compromised pipeline can ship anything.
- Who can change the pipeline and approve releases
- Secrets in repositories and build logs
- Security checks that can run automatically on every change
How it works
A review is scoped by the size of the code and the number of features. We give you a fixed price after a short call and a look at the repository.
Scoping
We agree on the applications, the repositories and the features that matter most, and sign a confidentiality agreement.
Review
We model the threats, read the design and the code and confirm each finding before reporting it.
Report and walkthrough
We present the findings to your developers, with the code location, the risk and the recommended fix.
Retest
After your team fixes the findings, we check each fix and update the report.
What we need from you
Read access to the code
The repositories in scope, with access you grant and remove.
Architecture documents
Diagrams or a walkthrough of how the system is built and deployed.
A test environment
A non-production environment and test accounts with different roles.
A technical contact
Someone who can answer questions about the code during the review.
Ways to work with us
Choose by how much of the application you want reviewed and how often.
| Option | Best for | What it includes |
|---|---|---|
| Focused review | A new feature or a sensitive area, such as payments or sign-in | Threat model and code review of that area, report and retest |
| Full review | An application before a launch, an audit or a large customer | Threat model, architecture and code review of the whole application, report and retest |
| Secure development program | Teams that ship often and want to keep the code safe | Reviews of important changes, security checks in the pipeline and training for developers |
Questions
How do you handle our source code?
Under a confidentiality agreement, with read-only access you grant and remove. The code is reviewed in your repository or in an isolated environment and is not kept after the engagement.
Which languages do you review?
The common web and back-end languages and frameworks, such as Python, Go, Java, JavaScript and TypeScript, PHP and C#. Tell us your stack during scoping and we confirm.
Do you also test the running application?
This service reviews the design and the code. Tell us during scoping if you also need the running application tested, and we will discuss the best option with you.
Other services
Tell us what you need.
We reply with a few questions about scope, then send a proposal with dates and price.