Vorpcel / Services / Assurance
We review the applications and APIs you build from the inside: the design, the code and the way they are built and deployed. Findings come with the line of code, the risk and the fix, written for the developers who will make it.
At a glance
Automated scanners find a part of the problems, and a firewall in front of the application blocks a part of the attacks. Flaws in business logic and authorization, such as one customer being able to read another customer's data, are found by reading the design and the code.
With access to the source, a review finds more in less time than testing from the outside, and each finding points to the exact place to change.
Missing checks that let a user read or change records of another customer by changing an identifier.
Endpoints that check who you are but not what you are allowed to do.
Passwords, keys and tokens committed to the repository or shipped to the browser.
Input from outside that reaches a database query, a command or a template without being handled safely.
Uploads and downloads that let someone store or read files they should not.
Third-party components with known vulnerabilities and an available fix.
With your architects and developers, we draw how data flows through the system and ask, at each step, what could go wrong and what stops it.
We look at the decisions that are expensive to change later: how users and services authenticate, how tenants are separated, how secrets are kept and how data is encrypted.
We combine automated analysis with manual reading of the parts that matter most: authentication, authorization, payments, file handling and anything that takes input from outside.
We review how code reaches production, because a compromised pipeline can ship anything.
A review is scoped by the size of the code and the number of features. We give you a fixed price after a short call and a look at the repository.
We agree on the applications, the repositories and the features that matter most, and sign a confidentiality agreement.
We model the threats, read the design and the code and confirm each finding before reporting it.
We present the findings to your developers, with the code location, the risk and the recommended fix.
After your team fixes the findings, we check each fix and update the report.
The repositories in scope, with access you grant and remove.
Diagrams or a walkthrough of how the system is built and deployed.
A non-production environment and test accounts with different roles.
Someone who can answer questions about the code during the review.
Choose by how much of the application you want reviewed and how often.
| Option | Best for | What it includes |
|---|---|---|
| Focused review | A new feature or a sensitive area, such as payments or sign-in | Threat model and code review of that area, report and retest |
| Full review | An application before a launch, an audit or a large customer | Threat model, architecture and code review of the whole application, report and retest |
| Secure development program | Teams that ship often and want to keep the code safe | Reviews of important changes, security checks in the pipeline and training for developers |
Under a confidentiality agreement, with read-only access you grant and remove. The code is reviewed in your repository or in an isolated environment and is not kept after the engagement.
The common web and back-end languages and frameworks, such as Python, Go, Java, JavaScript and TypeScript, PHP and C#. Tell us your stack during scoping and we confirm.
This service reviews the design and the code. Tell us during scoping if you also need the running application tested, and we will discuss the best option with you.
We reply with a few questions about scope, then send a proposal with dates and price.