Skip to content
HackIndex
Menu

Your code, read through the eyes of an attacker.

HackIndex reads your source code and looks for vulnerabilities, including the ones you cannot see from outside. For each finding you get the file, the line and the fix.

Request a code review What does it cost?
  • File and line for each finding
  • Fix as a code change
  • GDPR code check available on top

When

Sound familiar?

  • The code has grown fast.

    Several developers, deadlines and little time for review. A fresh look finds what slipped in.

  • A codebase comes over from another party.

    With an acquisition or a new supplier you want to know what you are taking on.

  • A pentest alone is not enough.

    Some flaws are invisible from outside. In the code they are right there.

  • Part of the code was written with AI.

    Generated code often works, but skips checks just as often.

Scope

Where in your code the review looks

The review follows what comes in: where it is checked, where it is stored and where it goes. Pick a part.

Application

Project

What the test answers

Access

Which doors are open?

  • Parts that can be reached without logging in
  • Forgotten test and debug features

What the test answers

User input

Is everything that comes in checked?

  • Input that is used without a check
  • Uploads and redirects

What the test answers

Permissions

Is this user allowed to do this?

  • Checks that are missing or too loose
  • A check on role, but not on who owns it
  • The separation between customers

What the test answers

Stored data

What can be done with what is stored?

  • Fields a user should not be able to change
  • Sensitive data that leaves too easily

What the test answers

Background jobs

What runs without anyone watching?

  • Jobs that process data without checking permissions
  • Exports and integrations in the background

What the test answers

Settings

Are the safe settings switched on?

  • Test and debug settings in production
  • Passwords and keys in the code

What the test answers

Packages in use

What are you pulling in?

  • Known vulnerabilities in open-source packages
  • Packages that are no longer maintained

What the test answers

Code history

What was ever committed?

  • Passwords and keys in older versions of the code

From a report

What a finding looks like

For each finding what is wrong, the evidence, what it means and how to fix it.

Reference
HI-OP-2026-9HWE-02
Severity
High
CVSS
4.0 8.7 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Where
app/Http/Controllers/ProfileController.php, line 42
Who can do this
Any logged-in user
Retest
Fixed

Any user can make themselves an administrator through their profile

The profile form saves everything that is sent, including the field that decides whether someone is an administrator.

Evidence

// app/Http/Controllers/ProfileController.php, line 42
public function update(Request $request)
{
    $request->user()->update($request->all());
}

Impact

A regular user can manage every account, all data and all settings of the platform. From outside you only find this by luck. In the code it is right there.

Fix

app/Http/Controllers/ProfileController.php

public function update(UpdateProfileRequest $request)
{
Removed: $request->user()->update($request->all());
Added: $request->user()->update($request->validated());
}

A made-up example. Real findings stay confidential.

View the sample report

Clear up front

What is and is not included

IN Part of the job

  • The agreed repository or parts
  • Access, permissions and how input is handled
  • Settings, keys and packages in use
  • A debrief with your developers

OUT Not included

  • Testing the running app, that is what a pentest is for
  • Code quality and style, this is about security only
  • Infrastructure and hosting, unless it lives as code in the repository
  • GDPR, unless you add the GDPR code check

Price

What does it cost?

After a short look at the repository you get a fixed price. These points decide the size.

from, excl. VAT

€1,520

Fixed price, no extra charges afterwards

GDPR code check on top from €1,150

  • Size How much of your own code falls within the review.
  • Framework Laravel, WordPress and React Native go faster thanks to experience with their conventions.
  • Focus The whole codebase, or just a part such as the API or a new module.

Preparation

What you provide

The better this is ready, the more time goes into the testing itself.

  • Needed Read access to the repository An invitation in GitHub or GitLab that you revoke afterwards.
  • Needed A short explanation of the app What the app does, which roles there are and what is most sensitive.
  • Optional A developer as point of contact For questions about choices in the code.

Combine

More coverage in one job

This service

Security code review

from €1,520

Your code checked for vulnerabilities.

On top

GDPR code check

from €1,150

The same code is then also checked on how it handles personal data, in one round.

More about GDPR code check

Frequently asked questions

What is the difference with a pentest?

A pentest tests the running app from outside. A code review reads the code itself. Together they give the most coverage.

How do we share the code safely?

With a read invitation in GitHub or GitLab that you revoke after the review. The code is covered by the NDA and only used for this review.

Can it cover part of the code?

Yes, for example just the API or a new module. That makes the review smaller and cheaper.

Do you look at GDPR as well?

Only when you add the GDPR code check. It can also be ordered on its own.

Can a code review also check code written by AI assistants?

Yes. Code from an AI assistant is reviewed the same way as code written by people, with extra attention to checks on permissions and input that are often missing.

Get your code reviewed.

Tell which language, how big and what is most sensitive. You'll receive a proposal with a fixed price.

Request a code review

Other services