Code audit · from €1,900 excl. VAT
The code audit. The cause, not the symptom.
The code audit reads your source code and finds the causes of vulnerabilities, including those an external test never triggers. Scanners and AI agents check secrets, dependencies, OWASP patterns, build and code quality. We work read-only.
- Price
- from €1,900 excl. VAT
- Delivery
- 5 working days
- Access
- Read access to the code
- Result
- Report with action plan
All prices net, plus VAT. For businesses only. Contract by individual offer.
What we check
- Secrets and keys in the code
- Dependencies with known CVEs
- OWASP Top 10 with AI review
- Code quality, supply chain, CI/CD
- Prioritised action plan
How it works
- 01
Hand over the code
Read access to the repository or an encrypted archive. NDA and DPA first.
- 02
Analysis
Tools and AI agents check in parallel, a second agent tries to refute every finding.
- 03
Report
Findings with file and line, CVSS risk and a concrete recommendation.
What you get
- Findings with location in the code
- CVSS 3.1 and CWE ratings
- Prioritised action plan
- Raw data from every tool
Compared
| Security checkfree | App auditfrom €990 | Code auditfrom €1,900 | Full auditfrom €5,900 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | |||||
| Exposed files, admin and debug pages | |||||
| Login, sessions, rate limits | |||||
| Access rights: can user A see user B’s data? | |||||
| Injection (SQL, XSS, SSRF) | |||||
| Secrets and keys | |||||
| Dependencies and known CVEs | |||||
| Supply chain, Docker, CI/CD | |||||
| Code quality and maintainability | |||||
| Architecture review and threat modelling | |||||
| Cloud infrastructure (AWS, Azure, Kubernetes) | |||||
| What you get | |||||
| Grade and number of findings | |||||
| Report with a prioritised action plan | |||||
| CVSS 3.1 ratings | |||||
| Code findings proven in the running app | |||||
| Expert review of every finding | |||||
| Debrief and re-check | |||||
| NIS2 and CRA readiness mapping | |||||
| Dedicated contact, recurring audits | |||||
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | within 2 hours on working days | 3 working days | 5 working days | 10 working days | individual |
includedpartlynot included
Frequently asked questions
Is my code stored?
Only for the duration of the audit, encrypted on our side. We work read-only, the AI stores nothing, and we delete the code once the audit is done.
Which languages do you cover?
Among others C#/.NET, Java, Kotlin, TypeScript/JavaScript, Python, PHP and Go with the common frameworks.
Does it help with the Cyber Resilience Act?
The report documents the state of your software and prioritised measures. It does not replace a conformity assessment.