Applications, APIs, source code
Application & Source Code Security Review
Test the business logic the scanner cannot understand. Authorization, tenant boundaries, transaction rules, secrets, integrations, and deployment architecture require human review across code and running systems.
The engagement
Architecture sets the test plan
Applications fail at the boundaries between code, identity, data, infrastructure, and business process. GDF combines architecture review, source analysis, dependency review, API testing, and controlled dynamic testing. The assignment can support release assurance, transactional diligence, remediation verification, or a focused review after an event.
Review begins with data flows, trust boundaries, authentication, authorization, tenancy, administrative functions, secrets, third-party services, queues, storage, logging, and deployment. Threat scenarios are tied to the application's actual users and transactions rather than copied from a generic checklist.
Static tools can identify candidates. Reviewers trace data and control flow to determine whether the condition is reachable and consequential. Dynamic tests verify behavior in an approved environment. Manual work targets access-control errors, unsafe state changes, injection, insecure deserialization, server-side request forgery, file handling, concurrency, and misuse of privileged workflows.
Scope
Architecture review
Data flows, trust boundaries, authentication, authorization, tenancy, administrative functions, secrets, third-party services, queues, storage, logging, and deployment reviewed.
Manual source-code review
Reviewer-led analysis of critical paths: authentication, authorization, tenant isolation, session, data handling, and administrative workflows. Static findings validated for reachability.
Authentication and session
Login flows, MFA integration, session lifecycle, token handling, refresh, and revocation reviewed. Federation and SSO integration tested where in scope.
Authorization and tenant isolation
Role and attribute checks, tenant boundary enforcement, indirect object references, and administrative privilege transitions tested against the application's actual users.
API and integration testing
REST, GraphQL, and internal API surfaces tested for authorization, input handling, rate limiting, and integration trust. Third-party integration behavior verified.
Dependency, secret, and deployment
Software composition, secret handling, container and image configuration, CI/CD trust, and deployment settings reviewed. Runtime configuration validated against source.
Retest and residual
Retesting follows the original route and agreed adjacent conditions, records environment and date, and identifies residual or untested exposure.
Methodology
How the review runs
-
Scope
Application context, users, transactions, data sensitivity, and prior findings inform the test plan. Access, environments, and approvals are agreed.
-
Review
Architecture and code are reviewed. Static tools identify candidates. Reviewers trace data and control flow to determine reachability and consequence.
-
Test
Dynamic tests verify behavior in an approved environment. Access-control, business-logic, and privilege transition scenarios are exercised.
-
Report and retest
Findings are written for the person making the change. Retest follows the original route and adjacent conditions and records residual or untested exposure.
Evidence commonly examined
Evidence reviewed
- Source repository access and build configuration
- Application deployment topology and infrastructure records
- Authentication, identity provider, and session configuration
- API definitions, integration contracts, and third-party records
- Dependency manifests and container images
- Runtime logs and monitoring configurations
What you can expect
What you receive
- Ranked findings with affected component, reproduction, and consequence
- Code and configuration context for each material finding
- Recommended correction and developer-ready fix guidance
- Retest evidence for corrected findings
- Residual and untested exposure summary
Frequently asked
Common questions
Do you use only automated scanning?
No. Static and dynamic tools identify candidates; reviewer analysis determines reachability and consequence. Business logic, authorization, and tenant isolation require human review that a scanner cannot substitute.
Can you support M&A or diligence timelines?
Yes. Scoped diligence reviews can prioritize architecture, authentication, tenant isolation, and dependency exposure. Findings are ranked so the acquirer sees the material items within the diligence window.
How is sensitive test evidence handled?
Sensitive test evidence is separated from broad executive distribution. Reproduction detail is provided to the technical owners; summaries are prepared for governance audiences.
Related capabilities
Related services
Talk with an examiner
Discuss the matter and the next step.
Call to discuss timing, scope and the safest way to share information. Do not send evidence or credentials by email.
24/7 hotline: 1-800-868-8189