Book a scoping callBook a call

The flaw behind the bug, on the line

White-box review with full access. We follow untrusted input from where it enters to where it does damage, and pin the finding to the exact file and line.

Source to sink

Trace untrusted input to the dangerous operation

With access to the code, we follow untrusted input from its entry point through each transformation to the operation that makes it dangerous. The finding identifies the affected file, line and data flow.

Source: where untrusted input enters
Flow: every hop it takes, unsanitised
Sink: the operation it should never reach
routes/reports.js:40
38app.get('/report', (req, res) => {
39 const id = req.query.idsource
40 const sql =
41 "SELECT * FROM reports WHERE id = " + idsink
42 db.query(sql, (err, rows) => {
43 res.json(rows)
44 })
45})
Highreq.query.id reaches a raw SQL string. Unsanitised. SQL injection.
What we look for

What the code reveals

A representative sample of the dozens of checks we run against the OWASP ASVS and secure-code-review practice, spanning injection, auth logic, cryptography, secrets, and dependencies.

Injection flaws traced to the exact line

user input reaching a query or command, followed to the file and line.

Authentication and access-control logic errors

the role check that is missing, or wrong, on a path that matters.

Unsafe use of cryptography and secret handling

home-rolled crypto, weak algorithms, keys and tokens hard-coded in the repo.

Dangerous and known-vulnerable dependencies

third-party packages with known vulnerabilities pulled deep into the tree.

Business-logic flaws invisible from outside

the flawed assumption in the code that no black-box test would reach.

5 checks
Injection flaws traced to the exact line

user input reaching a query or command, followed to the file and line.

Authentication and access-control logic errors

the role check that is missing, or wrong, on a path that matters.

Unsafe use of cryptography and secret handling

home-rolled crypto, weak algorithms, keys and tokens hard-coded in the repo.

Dangerous and known-vulnerable dependencies

third-party packages with known vulnerabilities pulled deep into the tree.

Business-logic flaws invisible from outside

the flawed assumption in the code that no black-box test would reach.

How we test

Read the code, trace the flow and confirm reachability

Step 01

Understand the code

Architecture, trust boundaries and every entry point where input arrives.

Step 02

Trace the taint

We follow untrusted input from each source to every dangerous sink it reaches.

Step 03

Confirm exploitability

We confirm that the dangerous path is reachable under the tested conditions.

What you get

A finding pinned to the file, line and data flow

Your developers land on the exact code, and the reason untrusted input turns dangerous.

Penetration Test Report
acme-app / source / engagement summary
01Findings pinned to file and lineThe affected file, line and operation are identified for the engineering team.
02The data-flow path, source to sinkEvery hop the tainted input takes to the sink.
03Fix guidance in your languageThe safe pattern for the stack you build in.
04Free retesting for one yearAfter you remediate a finding, we rerun the original proof against the agreed code version and record the result.
The actual report, page by page
Watermarked sample report page: The report your team receives
01The report your team receives
Watermarked sample report page: Executive summary
02Executive summary
Watermarked sample report page: Findings, ranked by impact
03Findings, ranked by impact
Watermarked sample report page: Recommendations
04Recommendations
Watermarked sample report page: A finding, reproduced in full
05A finding, reproduced in full
5 sample pages

You're seeing 5 pages. The full report is the complete PDF a customer receives.

Confirmed source-code findings appear with the entry point, dangerous operation and affected line. Your engineers can discuss the cause, link the fix and request a retest against the agreed code version.

See how delivery works

Explore other surfaces

Web ApplicationAPINetworkCloudMobileAI / LLM
Get started

Find the flaw at the line, before it ships

Book a scoping call and we'll define the repositories, languages, access and review depth together. Confirmed findings will appear in Outer Core during the engagement.

Book a scoping call