Secure Source Code Review in India & UAE.
Line-by-line review of your source by OSCP/OSWE-trained reviewers, paired with commercial SAST and SCA tooling. Covers Java, .NET, Node.js, Python, Go, PHP, Ruby, Swift and Kotlin — mapped to OWASP Top 10, SANS Top 25 and the CWE taxonomy your auditor expects.
What is secure code review?
Secure code review manually inspects your application's source code to find vulnerabilities black-box testing misses — hardcoded secrets, injection sinks, broken authorization, and unsafe crypto. Macksofy combines expert manual review with SAST, mapping findings to OWASP ASVS and CWE risk, for BFSI and SaaS across India.
Not a Semgrep dump with our logo on it.
Every finding is human-confirmed before it reaches your report. You get the line, the class, why it is exploitable in your code specifically, and the patch — not a rule ID and a severity colour.
- Catch flaws at SDLC stage where remediation costs ~10× less than post-prod
- Satisfy CERT-In, RBI IT Governance, SEBI CSCRF, ISO 27001 A.14 and SOC 2 SDLC controls
- De-risk pre-launch releases and M&A code due diligence (SBOM + risk inventory)
- Reduce production CVSS exposure surface before a public push
- Train your dev team on secure-by-default patterns via the walkthrough handoff
Polymorphic deserialization to RCE
Default typing lets the payload name its own class. A gadget on the classpath turns a JSON body into code execution — no authentication bypass required first.
ObjectMapper mapper = new ObjectMapper();-mapper.enableDefaultTyping();-Payload p = mapper.readValue(body, Payload.class); ObjectMapper mapper = new ObjectMapper();+mapper.deactivateDefaultTyping();+mapper.activateDefaultTyping(+ BasicPolymorphicTypeValidator.builder()+ .allowIfBaseType(Payload.class).build(),+ ObjectMapper.DefaultTyping.NON_FINAL); Payload p = mapper.readValue(body, Payload.class);Every finding ships like this — file and line, CWE, exploitability, and a patch your developers can paste rather than pseudo-code they have to interpret.
Tools for breadth. A reviewer for the rest.
SAST and SCA get us across the whole codebase quickly and cheaply. Authentication, crypto, business-logic authorisation, deserialization and trust boundaries are read by hand, because that is where the findings that matter live.
▸Deserialization sinks, JWT handling, Spring Security filter chains
▸Model binding / mass assignment, BinaryFormatter, auth attributes
▸Prototype pollution, second-order injection, middleware ordering
▸SSRF in fetch helpers, pickle usage, ORM raw-query escapes
▸Race conditions, context propagation, template auto-escaping gaps
▸Object injection, file-upload handling, nonce and capability checks
▸Strong-params gaps, ERB injection, Active Record raw SQL
▸Keychain / Keystore use, cert pinning, IPC and deeplink surfaces
Seven phases, pinned to a branch.
The review is run against a pinned tag so it stays reproducible — and so the retest compares like with like.
- ▸Mutual NDA + source-handling agreement (on-prem review or read-only repo grant)
- ▸Language + framework inventory, third-party dependency list
- ▸Crown-jewel module identification (auth, payments, PII handling, admin)
- ▸Branch / tag pin so the review is reproducible
- ▸SAST sweep (Semgrep, SonarQube, CodeQL, Checkmarx / Fortify when client-licensed)
- ▸SCA + SBOM (OWASP Dependency-Check, Snyk, Trivy) — known CVEs in third-party libs
- ▸Secrets scan (Gitleaks, TruffleHog) across full git history, not just HEAD
- ▸Lint + style baseline to surface dead branches and unreachable code
- ▸Authentication, session and password handling
- ▸Cryptography: algorithm choice, key handling, IV/nonce reuse, JWT pitfalls
- ▸Input validation, output encoding, injection sinks (SQLi, XSS, SSRF, RCE, XXE, LDAP, NoSQL)
- ▸Business-logic authorization (BOLA, IDOR, mass-assignment, race conditions)
- ▸Deserialization, file upload, path traversal, SSRF + DNS rebinding
- ▸Logging, error handling, secret material in logs
- ▸Source-to-sink tracing for high-risk sinks (CodeQL queries + manual)
- ▸Trust-boundary crossing review (request → DB, request → file, request → shell)
- ▸Tenant-isolation review for multi-tenant SaaS
- ▸False-positive elimination — every reported finding is human-confirmed
- ▸Exploitability + business-impact scoring (CVSS 3.1 + Macksofy risk rating)
- ▸PoC or repro snippet for every High / Critical
- ▸Executive summary (board-ready, 2–3 pages)
- ▸Findings inventory: file:line, CWE, CVSS, exploitability, recommended fix
- ▸Inline patched code snippets — copy-pasteable, not pseudo-code
- ▸SDLC-integration recommendations (pre-commit hooks, CI gates, IDE plugins)
- ▸Live walkthrough session with the development team
- ▸Q&A on secure-coding patterns and refactor strategy
- ▸Free retest of remediated findings within 30 days of fix submission
- ▸Compliance evidence letter (ISO 27001 A.14 / SOC 2 / CERT-In / PCI-DSS req 6.3)
The objection is always the same. Here is the answer.
Handing your source to an external firm is a bigger decision than booking a pentest. These four controls are contractual, not aspirational.
Mutual NDA and a source-handling agreement are signed before you grant any access. Both are standard documents we can turn around same-day.
Default is read-only access to a pinned branch on your GitHub, GitLab, Bitbucket or Azure DevOps. For BFSI, defence and healthcare codebases we review on-prem from a laptop inside your building, or a jump-host VM you control.
Only the assigned reviewer holds access. Source is encrypted at rest for the engagement window and never forked, mirrored or copied into a shared workspace.
Everything is destroyed 30 days after the retest closes. We retain the report, not your code.
Found pre-prod. Fixed pre-prod.
Scope · Customer-facing Java / Spring Boot monolith, ~340 KLOC
Finding · 7 hardcoded JWT secrets across env profiles + 3 second-order SQLi in admin module surfaced via Semgrep custom rules and confirmed manually
Critical — pre-prod fix shipped before public launch; saved estimated ₹3 Cr breach-cost exposure
Scope · Node.js + Python microservices (12 services, ~180 KLOC)
Finding · Insecure Jackson deserialization → RCE in 2 microservices, traced via CodeQL taint analysis from REST handlers to ObjectMapper.readValue
Critical — patched in 5 working days; HIPAA-aligned customer notification avoided
Scope · .NET 6 portal + Python report-generation service
Finding · SSRF in PDF generation library (chained Server-Side request → internal metadata service) and IDOR across 4 admin endpoints
High — disclosed to internal SOC; remediated under CERT-In coordinated disclosure
A review you only need once per class of bug.
The report closes with an SDLC-integration playbook and a live walkthrough with your developers. The point is that the same finding does not come back next release.
Semgrep rules tuned to your repo plus Gitleaks, so the class of bug we found cannot land again.
Fail-the-build thresholds you choose, wired into the pipeline you already run.
Findings exported as actionable Jira or Linear issues, not a PDF someone has to retype.
Commercial, open-source, and rules we write for you.
Where you already license Checkmarx or Fortify we run inside your tenancy. Custom Semgrep and CodeQL queries written during the engagement are handed over at the end — they are yours.
Every codebase is different. So is every quote.
Source review pricing depends on KLOC, language mix and crown-jewel module count — not a fixed tier. Share your stack and we’ll send a fixed-price proposal within 48 hours, NDA-first.
What lands in your inbox
- Executive summary (board-ready, 2–3 pages)
- Per-finding report: file:line, CWE, CVSS 3.1, exploitability, business impact
- Runnable PoC or repro for every High / Critical finding
- Inline fix snippets — production-ready, not pseudo-code
- Software Bill of Materials (SBOM) in CycloneDX / SPDX format
- SDLC-integration playbook: pre-commit hooks, CI gates, IDE plugins
- Free retest of fixed findings within 30 days
- Compliance evidence letter (ISO 27001 A.14 / SOC 2 / CERT-In / PCI-DSS 6.3)
Sectors we operate in
Empanelled by CERT-In. Accredited by EC-Council.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things people ask before sharing source.
Where Macksofy delivers Code Review.
On-site engagements across India's BFSI, fintech, government and SaaS metros plus the UAE. Senior consultants fly from Mumbai BKC for kickoff, key reviews and exit briefings; remote weeks run through the rest of the engagement.
Macksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- Thousands of professionals trained
- India + UAE engagements