Application Security

Source Code Review

A source code review is combined with a penetration test of the running application; the report follows within 5 business days.

What is reviewed and why it matters

Code-level analysis that confirms what automated tools cannot contextualise.

Automated static analysis tools flag thousands of potential issues, but most are false positives or low-impact patterns that do not reflect real-world risk. Business logic flaws, authentication bypasses in branching code, hardcoded secrets buried in configuration files, and unsafe deserialization patterns require manual expert review to identify and confirm. A security-focused code review by experienced ethical hackers provides context-specific findings: the reviewer understands how the code behaves in the application context, which paths are reachable by an attacker, and which weaknesses can be chained together to build a targeted attack. Combined with a penetration test, the review confirms whether code-level weaknesses are exploitable in the running application.

Standards OWASP Code Review Guide, ASVS, CWE Top 25

Attack surface Authentication logic, access control branches, input validation, secrets handling

Approach Manual security-focused code analysis combined with automated scanning

Who needs this assessment

Organisations that build custom software handling sensitive data.

This assessment is designed for development teams and organisations that want to identify security vulnerabilities at the code level before deployment, rather than after.

Development teams building financial applications, healthcare systems, or government platforms handling sensitive data

Organisations preparing a major release that requires independent code-level security validation

Software companies that want to identify security vulnerabilities before deployment rather than after

Teams that have run automated SAST tools and need expert validation to distinguish real findings from noise

Organisations pursuing compliance certifications that require evidence of secure development practices

Healthcare and government organisations required to demonstrate secure coding practices for regulated software systems

Where these assessments are relevant

Financial services: customer portals, payment processing, and cloud-hosted transaction infrastructure.
SaaS and technology: application validation before production deployment or enterprise procurement.
Healthcare: digital systems handling patient data, clinical records, and connected medical devices.
Retail and e-commerce: web applications processing transactions, customer accounts, and payment data.

What the assessment produces

The insight and evidence delivered at the conclusion of the assessment.

Every assessment concludes with a structured report covering code-level findings, severity ratings, evidence, and remediation guidance tailored to the development workflow. Reports are delivered through the Pentrox Portal.

Identification of logic flaws, authentication bypasses, and insecure patterns that automated tools miss
Validation of input handling, session management, credential storage, and authorisation logic at the code level
Findings that include code references, risk context, and remediation suggestions tailored to the development workflow
Combined insight from code review and penetration testing, confirming whether code-level weaknesses are exploitable in the running application
Portal access with real-time findings, retest workflow, and report downloads for the lifetime of the client account

How an assessment runs

Scope and Intake
Planning
Assessment
Reporting
Findings & Retest

Retesting of remediated findings is included as standard with every assessment.

Review methodology

Five phases from scope definition through verified remediation.

Each phase builds on the previous one. Automated analysis surfaces known patterns, manual review provides context-specific findings, and penetration testing confirms whether code-level weaknesses are exploitable in practice.

Scope definition and code access

Critical modules are identified with the client: authentication, authorisation, payment processing, and externally exposed endpoints.

OWASP Code Review Guide (Planning and Preparation)

Automated analysis

Automated tools identify known vulnerability patterns and outdated dependencies. Findings are triaged to remove false positives before manual review.

CWE Top 25, SANS SWAT Checklist

Manual expert review

Authentication logic, access control branches, input validation, and secrets handling are reviewed manually. Data flows are traced from input to storage and output.

OWASP Code Review Guide (Reviewing Code for Key Vulnerabilities), OWASP ASVS

Penetration test validation

Code-level findings are validated using Burp Suite Professional against the running application, confirming whether weaknesses are exploitable in practice.

OWASP WSTG, PTES (Vulnerability Analysis, Exploitation)

Reporting and quality review

Each finding includes the code location, risk context, and remediation guidance. Code review and penetration test findings appear in a single report.

OWASP Risk Rating Methodology (severity rating), OWASP Code Review Guide (Reporting)

Scope and deliverables

What is included, what is excluded, and what is delivered.

The statement of work defines the exact codebase, languages, and critical modules before the assessment begins. The lists below reflect the standard scope for a source code review.

In scope

Manual, security-focused code analysis of the agreed codebase
Authentication and authorisation logic review
Input validation, output encoding, and injection pattern analysis
Session management and credential storage review
Secrets, configuration, and connection string handling assessment
Third-party dependency and supply chain risk analysis
Unsafe deserialization and file handling pattern review
Penetration test validation of code-level findings against the running application

Out of scope

Full infrastructure penetration testing beyond the application layer
Code quality, performance, or functional review (the scope is security-focused)
Automated SAST tool procurement or configuration advice
Review of code not provided to Pentrox or outside the agreed scope boundary

What you receive

Executive summary Severity distribution, risk overview, and remediation priorities written for leadership.
Detailed findings Each vulnerability documented with code references, evidence, OWASP risk rating, and remediation guidance.
Technical conclusion Insecure coding patterns, control gaps, and structural recommendations beyond individual fixes.
Scope and strategy description Goals, test approach, and scope boundaries for audit traceability.
Portal access Real-time findings, report downloads, retest workflow, and team management through a dedicated platform.
Findings meeting A scheduled session to align on risks, priorities, and the remediation approach.
Retest report Verification results after remediation, documenting each finding with its updated status.

Pentrox Portal report library showing the four report types available for download

See what a Pentrox report looks like before you decide

OWASP Top 10 in practice

The web and API weaknesses that turn up most often, with the fix for each.

Blind SQL injection behind rate limiting

Where an unescaped value reaches a query, and how the data leaves over DNS.

Why the report is the real deliverable

What a strong report contains for the board and for the developer.

When independent assessment is the right step

An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.

Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.

Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.

Request a scoping call

Timeline

Illustrative durations to support planning. Confirmed in the statement of work.

Source code review is performed together with a web and API penetration test. Duration depends on the size of the codebase, the number of critical modules, and the languages involved. The calibration bands below are indicative. Exact duration is confirmed in the statement of work.

Small scope 3 to 4 testing days Single application with one language, limited authentication complexity, and a focused module set

Core scope 4 to 6 testing days Multi-module application with role-based access control, external API integrations, and combined penetration testing

Complex scope 6+ testing days Large codebase with multiple languages, complex authentication flows, and extensive third-party dependencies

Report delivery 5 business days Initial report and management report are delivered shortly after testing is completed.

Retest Included as standard Retesting within 90 days after report delivery is included at no additional cost.

What determines duration

Size of the codebase and number of critical modules to review
Number of programming languages and frameworks in use
Complexity of authentication and authorisation logic
Whether the review is combined with a full web and API penetration test
Availability of application documentation, architecture diagrams, and developer access

Actual duration is confirmed during scoping and depends on codebase size and complexity. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.

Why Pentrox

The operational standards behind every source code review.

These operational standards apply to every source code review Pentrox delivers, regardless of language or codebase size.

Manual expert review, not automated output

Business logic flaws and authentication bypasses that SAST tools do not detect.

Experienced ethical hackers trace data flows from input to storage to output. Context-specific findings identify vulnerabilities that automated tools cannot contextualise.

Combined with penetration testing

Code-level findings validated against the running application.

Source code review is performed together with a web and API penetration test. Code-level context informs the penetration test. Hands-on testing confirms exploitability.

Remediation guidance for developers

Findings include code references and fixes tailored to the development workflow.

Each finding references the exact file, function, and line. Remediation guidance is written for the development team and can be implemented directly.

Broad language coverage

Java, C#, JavaScript, Python, PHP, and Go.

The reviewer is matched to the language and framework of the target codebase. Additional languages may be supported on request and confirmed in the statement of work.

Portal-delivered results

Findings visible in real time through the Pentrox Portal.

The Pentrox Portal provides remediation tracking, retest requests, report downloads, and team access management. Two-factor authentication and role-based access control are enforced on every account.

Frequently asked questions

Practical answers for security teams and procurement officers.

Can source code review be purchased as a standalone service?

Source code review is performed together with a web and API penetration test. The combined approach validates code-level findings against the running application, providing higher confidence than code review alone. The statement of work defines the scope of both the review and the penetration test.

Which programming languages are supported?

Supported languages include Java, C#, JavaScript, Python, PHP, and Go. Additional languages may be supported on request. The statement of work confirms the languages in scope for each assessment.

Is this the same as running a SAST tool?

Automated static analysis tools are used as input for the review, but the core of the assessment is manual expert analysis. Experienced ethical hackers trace data flows, review authentication logic, and identify business logic flaws that automated tools cannot contextualise. The manual phase distinguishes confirmed vulnerabilities from false positives and noise.

Is retesting included?

Retesting of remediated findings is included as standard with every assessment. There are no additional charges. The client flags remediated findings through the Pentrox Portal and submits a retest request. Results are published through the Portal once the verification is complete.

How is sensitive source code protected during the review?

All Pentrox employees undergo PES (Personnel Screening) background checks. A non-disclosure agreement is available on request. Data handling, retention, and access controls are agreed in the statement of work before the codebase is shared. Pentrox does not retain source code after the assessment unless explicitly agreed with the client.

Can this report be used as audit evidence?

The report is structured for audit traceability, with a clear scope description, named standards (OWASP Code Review Guide, CWE Top 25), severity ratings, and remediation status per finding. It is worth noting that the report documents the security review; it does not replace a compliance audit.

How is assessment data handled and who has access to findings?

Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.

What happens when a critical vulnerability is found during testing?

Critical or blocking vulnerabilities are communicated immediately through the channel agreed at kickoff. Findings are published in the Pentrox Portal as they are confirmed, so remediation can begin before the final report is delivered. The escalation path is documented in the statement of work.