Secure code review
Line-by-line review of the parts that matter: authentication, authorization, input handling, cryptography and payments.
Application security · Code review · API testing
Find the vulnerability before someone else does.
SexurityCode is an independent application security practice. We review source code, test web applications and APIs, and help engineering teams fix what matters — with findings developers can actually reproduce.
SC-26-031Medium
Timing side channel in webhook signature check
billing/webhooks.py:48
expected = sign(key, body)- if req.headers["X-Signature"] == expected:+ sig = req.headers.get("X-Signature", "")+ if hmac.compare_digest(sig, expected): process(event)
Reproduced · Fix verified on retest
What we do
Security work, done by people who write code.
Every engagement is hands-on and led by an engineer who reads your code, not a scanner report with a logo on it.
Web & API testing
Authenticated testing of web apps and REST or GraphQL APIs against your real business logic.
Threat modeling
A working session with your engineers to map trust boundaries and decide what to fix first.
Developer training
Hands-on workshops built around the classes of bugs we keep finding, tailored to your stack.
How it works
From scope to verified fix.
Scope
Share the repository or target and your timeline. You get a fixed-scope proposal, usually within two business days.
Test
Manual review combined with targeted tooling. Critical issues are reported the same day, not at the end.
Report
Each finding comes with a reproduction, a severity rationale and a concrete fix written for developers.
Retest
Once fixes land, we verify them and issue an updated report you can share with customers or auditors.
Deliverables
Reports developers don't ignore.
A report is only useful if it gets fixed. Ours are written to be picked up straight from the backlog — no forty-page PDF of scanner output.
- Step-by-step reproduction for every finding
- Severity scored with CVSS v4.0 and explained in plain language
- Fix guidance with code examples for your framework
- Executive summary for non-technical stakeholders
- Retest of all fixed issues within 60 days, included
- Findings exported to Jira, GitHub Issues or Linear on request
From the blog
Notes on secure code.
-
Your webhook signature check is probably comparing strings wrong
Why == leaks timing information when you verify HMAC signatures, and how to fix it in Python, Node.js, Go and PHP.
-
Pin the algorithm: JWT confusion bugs that still ship
How trusting the alg header lets attackers forge tokens, and the few lines of configuration that prevent it.
-
Parameterized queries don't cover ORDER BY
Placeholders bind values, not identifiers. Where SQL injection still hides in codebases that 'always use prepared statements'.
Shipping something important soon?
Tell us what you're building. We reply within two business days.