Code audit · €890 excl. VAT
The code audit. The cause, not the symptom.
The code audit reads your source code and finds the causes of vulnerabilities, including those an external test never triggers. Scanners and AI agents check secrets, dependencies, OWASP patterns, build and code quality. We work read-only.
- Price
- €890 excl. VAT
- Delivery
- 2 working days
- Access
- Read access to the code
- Result
- Report with action plan
All prices net, plus VAT. Businesses only. Our terms and conditions apply.
What we check
- Secrets and keys in the code
- Dependencies with known CVEs
- OWASP Top 10 with AI review
- Code quality, supply chain, CI/CD
- Prioritised action plan
How it works
Methodology- 01
Hand over the code
Read access to the repository or an encrypted archive. NDA and DPA first.
- 02
Analysis
Tools and AI agents check in parallel, a second agent tries to refute every finding.
- 03
Report
Findings with file and line, CVSS risk and a concrete recommendation.
What you get
View sample report (PDF)- Findings with location in the code
- CVSS 3.1 and CWE ratings
- Prioritised action plan
- Raw data from every tool
Compared
| Security checkfree | App audit€490 | Code audit€890 | Full audit€1,690 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | included | included | partly | included | included |
| Login, sessions, rate limits | not included | included | included | included | included |
| Access rights: can user A see user B’s data? | not included | included | partly | included | included |
| Injection (SQL, XSS, SSRF) | not included | partly | included | included | included |
| Secrets and keys | partly | partly | included | included | included |
| Supply chain, Docker, CI/CD | not included | not included | included | included | included |
| What you get | |||||
| Grade and number of findings | included | included | included | included | included |
| Report with a prioritised action plan | not included | included | included | included | included |
| CVSS 3.1 ratings | not included | included | included | included | included |
| Debrief and re-check | not included | not included | not included | included | included |
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | usually within 2 hours on working days | 1 working day | 2 working days | 4 working days | individual |
Frequently asked questions
Is my code stored?
Only for the audit, encrypted on our side. We work read-only, the AI stores nothing, and we delete the code no later than 30 days after delivering the report.
Which languages do you cover?
Among others C#/.NET, Java, Kotlin, TypeScript/JavaScript, Python, PHP and Go with the common frameworks.
Does it help with the Cyber Resilience Act?
The report documents the state of your software and prioritised measures. It does not replace a conformity assessment.