C# code in the editor with a SonarQube finding on cognitive complexity

Code Review · Security Code Review

Code review, before small mistakes turn into big problems.

We review individual pull requests, critical components or entire codebases: from classic code quality to an in-depth security review.

An experienced second pair of eyes on your source code, with a clearly defined scope and concrete, prioritized findings. Whether it's a single pull request before merge or a codebase you've taken over: you get exactly as much review as your project needs.

Get your code reviewedRequest a security review

From our reviews

What a review actually turns up

Anonymised but true: figures and one example from code reviews we have already delivered.

Code reviews delivered
7+
Typical turnaround
5 working days
Most common critical finding
Missing authorization checks

An example from practice

Context
A software vendor had its multi-tenant microservice platform on .NET, EF Core and PostgreSQL reviewed for code quality, performance under load and security-relevant details.
Finding
Blocking .Result calls inside async database code, a random generator that wasn't cryptographically secure, and avoidable memory allocations in hot paths such as string building and logging.
Outcome
Every recommendation came with a benchmark and a code sample. Measured: up to 85% less memory per call and hot paths running up to almost five times faster.

Our offering

From a small review to a security assessment

Three levels that build on each other. Start where you are today and only extend when you need to.

Level 1

Code Review

The low-threshold entry point: an experienced look at code quality, readability and architecture, without compliance overhead.

Suitable for

  • Pull requests
  • Individual features
  • Critical functions
  • Architecture decisions
  • Hard-to-maintain code

Result

  • Concrete findings
  • Prioritized recommendations
  • Code comments or a compact review report
Request a code review
Level 2

Security Code Review

The deeper technical security assessment: on top of code quality, we specifically look for vulnerabilities in authentication, authorization, data handling and dependencies.

Suitable for

  • Security-critical applications
  • APIs
  • Auth, payment and permission logic
  • SaaS products
  • Applications handling sensitive data

Result

  • Security findings with severity
  • Affected code areas
  • Technical explanation
  • Concrete remediation
  • Optional retest
Request a security review
ExtensionOptional

NIS2 Software Assessment

For companies that additionally need structured evidence of relevant NIS2 security requirements, we extend the security code review with an assessment along NIS2 Art. 21, mapped to NIST SSDF and OWASP ASVS.

Suitable for

  • NIS2-relevant companies
  • Software suppliers to NIS2-relevant customers
  • Procurement and vendor assessments

Result

  • Assessment against defined controls
  • Documented evidence
  • Mapping to NIS2 Art. 21
View the NIS2 assessment

Focused reviews

Not every security review has to be a big audit.

You only want a critical pull request, a new authentication flow or a single module reviewed? That's exactly what our focused code reviews with a clearly defined scope are for.

Small scope means small effort: we agree up front what gets reviewed and how you receive the results.

Request a focused review

Typical examples

  • A single pull request
  • A new feature
  • A group of API endpoints
  • Authentication
  • Roles and permissions
  • File upload
  • Payment flow
  • Cryptography implementation
  • Dependency upgrade
  • Critical refactoring

What we check in a code review

The foundation of every review: quality, structure and maintainability of your code.

Clean Code & Readability

  • Naming and structure
  • Complexity and comprehensibility
  • Comments and documentation
  • Consistent coding standards

Architecture & Design

  • Modularity and dependencies
  • Design patterns and anti-patterns
  • Separation of concerns
  • Extensibility and flexibility

Testing & Quality Assurance

  • Test coverage and test quality
  • Unit, integration, and E2E tests
  • Code testability
  • CI/CD integration

What the security code review adds

We specifically target the vulnerability classes that lead to security incidents in practice, guided by the OWASP categories and known vulnerabilities in your technology stack.

Identity & Access

  • Authentication
  • Authorization and permission checks
  • Session management
  • API security

Input & Data

  • Input validation
  • Injection (SQL, command, template)
  • Secrets in code and configuration
  • Cryptography

Dependencies & Supply Chain

  • Dependency security
  • Supply chain risks
  • Known vulnerabilities (CVEs)
  • Outdated and unmaintained packages

Operations & Pipeline

  • Logging without sensitive data
  • Error handling
  • Security configuration
  • CI/CD-related risks

Methods & Boundaries

Which methods we use depends on your goal and scope. Not every engagement automatically includes all of them.

Possible methods

  • Manual source code review
  • Architecture understanding and data flows
  • SAST (static code analysis)
  • SCA (software composition analysis)
  • Secret scanning
  • Dependency review
  • Targeted manual tests
  • Complementary dynamic tests where needed

We agree on the concrete scope and methods together before we start.

Code review, penetration test or security assessment?

Code Review

White-box analysis of the source code. We see how your application is built and find vulnerabilities where they originate.

Penetration Test

Testing the running system from an attacker's perspective, typically with little or no insight into the code.

Security Assessment

Can combine both methods: the code review reveals the root cause, the dynamic test confirms exploitability in the running system.

How a review works

A lean process that works for a single pull request just as well as for a complete application.

  1. 01

    Scope

    We define the repository, branch or commit and the relevant components.

  2. 02

    Review

    Depending on the engagement: manual code review, security review and/or automated analysis.

  3. 03

    Findings

    You receive concrete findings with priority, code references and recommended actions.

  4. 04

    Fix

    Your development team implements the changes. We can support the remediation on request.

  5. 05

    Retest

    For security assessments, we can verify that relevant findings have been fixed.

Optional

NIS2 Assessment

If required, we extend the review with a control catalog along NIS2 Art. 21 and document the results.

More about the NIS2 assessment

What you get

Results depend on the agreed scope. A small code review does not automatically end with a formal report.

Code Review

  • Review comments directly in the pull request
  • Findings list
  • Prioritized recommendations

Formal report on request

Security Code Review

  • Executive summary
  • Technical security report
  • Severity classification
  • Remediation recommendations
  • Dependency and supply chain findings

Retest optional

NIS2 Assessment

  • SBOM review
  • NIS2 control assessment along NIS2 Art. 21
  • Assessment statement

Optional add-on

The services compared

What each level includes. The exact scope is always agreed before we start.

Code Review

Code quality
Included
Manual security review
optional
SAST/SCA
optional
Security findings
optional
Formal control catalog
Not included
NIS2 mapping
Not included
Evidence review
Not included
Retest
optional
Formal assessment report
optional

Security Code Review

Code quality
Included
Manual security review
Included
SAST/SCA
depending on scope
Security findings
Included
Formal control catalog
Not included
NIS2 mapping
Not included
Evidence review
optional
Retest
optional
Formal assessment report
optional

NIS2 Assessment

Code quality
Included
Manual security review
Included
SAST/SCA
per scope
Security findings
Included
Formal control catalog
Included
NIS2 mapping
Included
Evidence review
Included
Retest
planned
Formal assessment report
Included

Request a review

Tell us about your codebase

Three quick details are enough for a first assessment. We get back to you with a proposed scope and effort, no sales call required.

  • Reply within one business day
  • No access to your code needed for the first step
  • Scope and price agreed before we start
Sascha Kiefer

Sascha Kiefer will get in touch with you personally.

We only use your email to reply to this request.

Frequently asked questions

Yes. Many engagements are intentionally small: one pull request, one module or a new authentication flow. We agree on the scope up front so the effort stays manageable.
That depends on the scope. A single pull request or module is often reviewed quickly, while a review of several critical components typically takes a few days. For complete applications and security assessments, we plan a suitable timeframe together.
Not entirely. A code review analyzes the source code (white box), a penetration test the running system from an attacker's perspective. Both find different kinds of vulnerabilities and complement each other.
Only if you need structured evidence, for example because your company is itself NIS2-relevant, you supply software to NIS2-relevant customers or you have to meet requirements from procurement or vendor assessments. In all other cases, a code review or security code review is enough.
We need read-only access to the repository. Optionally, access to the CI/CD pipeline and documentation is helpful. All access is deleted after completion.
Our focus is on C#/.NET, TypeScript/JavaScript, React, and Node.js. For other languages, please contact us.
Yes, we also offer pair reviews or review workshops where we go through the code together with your team and teach best practices.

Ready for a second look at your code?

Tell us briefly what should be reviewed. We'll suggest a suitable scope, from a single pull request to a security assessment.

Request a code review

More on this topic in our blog: How to conduct effective code reviews