Documented case
Software firm
Root causes
a few design decisions explained most of the findings
For companies that build or buy software
Secure code review and secure software development
We review your code, the third-party libraries it uses and the running application before it goes to production. We show you the causes behind the findings, support your team while it fixes them and test again.
Free 30-minute consultation. We reply during business hours.
We sign the nondisclosure agreement before we receive your code. The reports are yours.
Pralogy is a cybersecurity firm that audits the software your team or your vendor builds. We review the code without running it (static application security testing, SAST), the third-party libraries (software composition analysis, SCA) and the running application (dynamic application security testing, DAST). You receive the findings grouped by root cause, the plan to fix them and a retest of what was fixed.
Is your company in one of these situations?
“We are about to go to production, and no one has reviewed the security of the code.”
“We sell software to a bank or a large client, and they are asking for evidence of secure development.”
“A vendor is delivering an application to us, and we do not know what is in it.”
“The same flaws show up in every release.”
Tell us what you are being asked for and by when. In the free 30-minute consultation, we talk about your application and the requirement you need to meet.
Request a free 30-minute consultation
Free 30-minute consultation. We reply during business hours.
What is included and what you receive
Executive report
For management, your client or the auditor: what was reviewed, what was found and how serious it is.
Technical report
For the people who make the fixes. Each finding comes with its severity, its evidence and how to fix it.
Findings grouped by root cause
Fixing the source of a problem can close several findings at once.
Remediation plan by priority
What to fix before going to production and what can wait, in order of impact.
What was done well
We also tell you which controls held up.
Remediation support and retest
Your team makes the fixes with our support hours. The review includes a retest at no cost up to three months later, to verify what was fixed. The hours and timelines are set in the proposal.
How we do it
Written scope and rules
We define repositories, environments and roles. We sign the nondisclosure agreement before we receive the code.
Code and library review
Tools and a specialist. We also look for keys and passwords written in the code or its history.
Testing the running application
Authorized and non-destructive by default. We confirm, narrow down or rule out what the code showed.
Report by root cause
Each finding comes with its severity and how to fix it, grouped by its source.
Remediation support and retest
Your team makes the fixes with our support. The retest shows what was closed and what is still open.
Real case · anonymized
What a real secure code review found
Anonymized case. These results are from this case.
Does your client require a test or a report?
Tell us about your application and the requirement you need to meet. With that, we define the scope and the deliverables in the proposal.
Free 30-minute consultation. We reply during business hours.
If you sell software to a financial institution
If your software is critical to a bank, an insurer or another regulated institution, your contract may include cybersecurity obligations, since a regulator may require the institution to include them. To verify them, the institution may ask you for evidence of how you develop and test your software. Share the requirement or the format you were given, and we will agree on the scope accordingly. The review provides evidence; the institution decides whether to accept it.
- Scope, repositories, environments, roles and dates in writing.
- An executive report to present to the institution or your auditor, and a technical report for your team.
- A retest with the result of each finding: what was closed and what is still open.
- A nondisclosure agreement signed before we receive the code.
Three reviews, because each one sees what the others miss
In the 2026 tests we analyzed, the critical findings came from the code review. Several depend on actions that a non-destructive test does not perform.
| Review | What it does, what it finds and what it misses |
|---|---|
| Code (SAST) | We read it without running it, with tools and a specialist. It finds missing validations, misapplied permissions and keys or passwords written in the code or its history. It misses how the application was configured at deployment. |
| Third-party libraries (SCA) | We review the third-party components your application uses. It finds the ones with known vulnerabilities or that are no longer supported, and the recommended update. It misses flaws in your own code. |
| Running application (DAST) | We test it while it runs, with authorization, the way a user or an attacker would. It finds configuration issues, permissions between roles and exposed environments. It misses what a non-destructive test does not perform and the code it does not reach. |
SAST, SCA and DAST stand for static application security testing, software composition analysis and dynamic application security testing.
The same, on an ongoing basis
If your team is about to release something new, we can test it first as part of the managed security program: testing of what changes and follow-up on open items.
Frequently asked questions
How much does a secure code review cost, and how long does it take?
It depends on how many applications and repositories need to be reviewed, and on their size. First, we talk in the free 30-minute consultation. If you want to continue, we send you a written proposal with the scope, the cost and the timeline.
Penetration test or secure code review: which one do I need?
If you have access to the code, the review covers the code and also tests the running application. If you do not, for example because your vendor does not share it, start with a penetration test, which tests your systems the way an attacker would.
What are SAST, SCA and DAST?
They are three types of review. SAST (static application security testing) reviews the code without running it. SCA (software composition analysis) reviews third-party libraries. DAST (dynamic application security testing) tests the running application. See what each one covers.
Which languages and technologies does your secure code review cover?
Tell us about your technology in the consultation, and we will confirm the coverage before the proposal.
We already have a scanner that checks every code change. Why a secure code review?
A scanner is a good starting point. The review explains why the same flaws keep coming back. In the review featured on this page, a single setting in the secrets scanner explained why the alarm never went off. We review the tool too.
Do you fix the code after a secure code review?
Your team or your vendor makes the fixes, with our remediation support hours. We keep finding and fixing separate so that the people who review do not grade their own work. The review includes a retest at no cost up to three months later, which verifies what was closed and what is still open. The scope, hours and timelines are set in the proposal.
Will a secure code review delay our launch?
We tell you what to fix before release and what can wait, in order of impact. The dates of the review and the retest are set in the proposal.
What do I receive from a secure code review?
An executive report, a technical report with the evidence and severity of each finding, the findings grouped by root cause and a remediation plan by priority. See what is included and what you receive.
Can a secure code review help us answer a bank or another client?
Yes, as evidence: the executive report can be presented to your client or your auditor, and the retest shows what was closed. See what changes if you sell software to a financial institution.
Our code is confidential. How do you protect it, and what does my team need to provide?
We sign a nondisclosure agreement before we start, and the reports are yours. In the scope, we agree on how to access the repositories, environments and roles, and when your team takes part.
Can you review each release before it ships?
Yes, within the managed security program: if your team is about to release something new, we can test it first. See the managed security program modules.
Let's talk about your application
Tell us what your application does, its technology and who is asking for the review. This is a conversation with our engineering team to understand your situation and suggest where to start.
Findings grouped by root cause, remediation support and a retest at no cost up to three months later.
What happens next: we reply during business hours to set a time. If you want to continue, we send you a written proposal with the scope, cost and timeline.