Advisory and training
Secure code review
Some vulnerabilities are easier to see in the code than from the outside. I read your code looking for them, focused on the parts where a mistake costs the most, and propose concrete fixes your team can apply. I use the OWASP ASVS 5.0 as the reference.
Quoted individually, based on the scope.
What's included
- Authentication, authorization and session handling.
- Input handling and injection.
- Use of cryptography and handling of secrets.
- Dependencies with known vulnerabilities.
- A review of the most sensitive changes before a release, if you need it.
What you get
- Findings with the file and line, why it's a problem and how to fix it.
- Recurring patterns your team can avoid from now on.
Who it's for
- Teams preparing a release that handles sensitive data.
- Code written quickly that never had a security review.
Not included
- Fixing the code myself (it can be quoted separately).
- General code quality reviews unrelated to security.
Process
How I work
-
Scope and authorization
We define what to test, how and when. Nothing starts without your written authorization.
-
Testing
Manual testing and review, supported by tools. If I find something critical, I tell you right away.
-
Report
You get every finding rated with CVSS v4.0, with the steps to reproduce it and the recommended fix.
-
Follow-up
I walk your team through the results and answer questions while you apply the fixes.
Frequently asked questions
Which languages do you review?
Go is where I work every day; I also read Python, JavaScript and other common languages. Tell me your stack when you write and I'll confirm.
Other services
- Architecture review Threat modeling and design review, before the decisions are expensive to change.
- DevSecOps Security built into your development process: pipelines, dependencies and secrets.
- Security training Hands-on secure development workshops for engineering teams.
- Web and API penetration testing Manual testing of web applications and APIs, the way an attacker would approach them.
Have a system to test or review? Send me the scope
Tell me what you need tested (applications, APIs or environments), by when, and any constraints, and I'll reply with the next steps. I work in English and Spanish.
hello@santiagopassafiume.comLooking for development? Websites, applications and backend projects go through RyuLabs.