# Security code review

# Your code, read through the eyes of an attacker.

HackIndex reads your source code and looks for vulnerabilities, including the ones you cannot see from outside. For each finding you get the file, the line and the fix.

**From €1,520 excl. VAT**. Fixed price once the scope is agreed

- **Delivery**: Read access to your repository
- **Result**: Findings with file, line and fix
- **On top**: GDPR code check
- **Start**: By arrangement, usually within two weeks
- **Report**: Within 10 working days of the review
- **Up front**: NDA, code only used for this review

[Request a code review](https://hackindex.nl/en/contact/details?parts=code)

## Sound familiar?

- **The code has grown fast.** Several developers, deadlines and little time for review. A fresh look finds what slipped in.
- **A codebase comes over from another party.** With an acquisition or a new supplier you want to know what you are taking on.
- **A pentest alone is not enough.** Some flaws are invisible from outside. In the code they are right there.
- **Part of the code was written with AI.** Generated code often works, but skips checks just as often.

## Where in your code the review looks

The review follows what comes in: where it is checked, where it is stored and where it goes. Pick a part.

### Application: Access

Which doors are open?

- Parts that can be reached without logging in
- Forgotten test and debug features

### Application: User input

Is everything that comes in checked?

- Input that is used without a check
- Uploads and redirects

### Application: Permissions

Is this user allowed to do this?

- Checks that are missing or too loose
- A check on role, but not on who owns it
- The separation between customers

### Application: Stored data

What can be done with what is stored?

- Fields a user should not be able to change
- Sensitive data that leaves too easily

### Application: Background jobs

What runs without anyone watching?

- Jobs that process data without checking permissions
- Exports and integrations in the background

### Project: Settings

Are the safe settings switched on?

- Test and debug settings in production
- Passwords and keys in the code

### Project: Packages in use

What are you pulling in?

- Known vulnerabilities in open-source packages
- Packages that are no longer maintained

### Project: Code history

What was ever committed?

- Passwords and keys in older versions of the code

## What a finding looks like

For each finding what is wrong, the evidence, what it means and how to fix it.

### HI-OP-2026-9HWE-02: Any user can make themselves an administrator through their profile

- **Severity**: High, CVSS 4.0 8.7, CVSS 3.1 8.8

The profile form saves everything that is sent, including the field that decides whether someone is an administrator.

```
// app/Http/Controllers/ProfileController.php, line 42
public function update(Request $request)
{
    $request->user()->update($request->all());
}
```

A regular user can manage every account, all data and all settings of the platform. From outside you only find this by luck. In the code it is right there.

```diff
public function update(UpdateProfileRequest $request)
{
-    $request->user()->update($request->all());
+    $request->user()->update($request->validated());
}
```

A made-up example. Real findings stay confidential.

## What is and is not included

### Part of the job

- The agreed repository or parts
- Access, permissions and how input is handled
- Settings, keys and packages in use
- A debrief with your developers

### Not included

- **Testing the running app**, that is what a pentest is for
- **Code quality and style**, this is about security only
- **Infrastructure and hosting**, unless it lives as code in the repository
- **GDPR**, unless you add the GDPR code check

## What does it cost?

After a short look at the repository you get a fixed price. These points decide the size.

**From €1,520 excl. VAT**. Fixed price, no extra charges afterwards

- GDPR code check on top: from €1,150

- **Size**: How much of your own code falls within the review.
- **Framework**: Laravel, WordPress and React Native go faster thanks to experience with their conventions.
- **Focus**: The whole codebase, or just a part such as the API or a new module.

## What you provide

The better this is ready, the more time goes into the testing itself.

- **Read access to the repository** (Needed): An invitation in GitHub or GitLab that you revoke afterwards.
- **A short explanation of the app** (Needed): What the app does, which roles there are and what is most sensitive.
- **A developer as point of contact** (Optional): For questions about choices in the code.

## More coverage in one job

- **Security code review** (from €1,520): Your code checked for vulnerabilities.

- **GDPR code check** (from €1,150): The same code is then also checked on how it handles personal data, in one round.

[More about GDPR code check](https://hackindex.nl/en/gdpr-code-check)

## Frequently asked questions

### What is the difference with a pentest?

A pentest tests the running app from outside. A code review reads the code itself. Together they give the most coverage.

### How do we share the code safely?

With a read invitation in GitHub or GitLab that you revoke after the review. The code is covered by the NDA and only used for this review.

### Can it cover part of the code?

Yes, for example just the API or a new module. That makes the review smaller and cheaper.

### Do you look at GDPR as well?

Only when you add the GDPR code check. It can also be ordered on its own.

### Can a code review also check code written by AI assistants?

Yes. Code from an AI assistant is reviewed the same way as code written by people, with extra attention to checks on permissions and input that are often missing.

## Get your code reviewed.

Tell which language, how big and what is most sensitive. You'll receive a proposal with a fixed price.

- [Request a code review](https://hackindex.nl/en/contact/details?parts=code)

## Other services

- [Web and API pentest](https://hackindex.nl/en/web-and-api-pentest): Web applications and APIs, with extra depth in Laravel and WordPress
- [Mobile pentest](https://hackindex.nl/en/mobile-pentest): iOS and Android apps, including the API behind them
- [GDPR code check](https://hackindex.nl/en/gdpr-code-check): How your code handles personal data

## Glossary

- **Debrief**: A call about the report: what was found, how serious it is and in which order to fix it.
- **Infrastructure**: The servers, network and hosting underneath your application, such as open ports and server settings. These fall outside a test of the application itself.

Source: https://hackindex.nl/en/security-code-review