# Secure Code Reviews

> Find security flaws in critical code, including authorization, business logic, and state changes.

Canonical page: https://www.guvenkaya.co/services/secure-code-review

**Find security flaws in your critical code.** We trace inputs, permissions, state changes, and dependencies through backend services, libraries, and infrastructure code.

## Follow input, authority, state, and dependencies through the code.

- **Inputs**: Untrusted data, messages, files, requests, events, and boundary validation.
- **Identity & authorization**: Authentication, roles, ownership, delegation, and policy enforcement.
- **State & business logic**: Invariants, sequencing, concurrency, retries, accounting, and intended behavior.
- **Sensitive actions**: Signing, secrets, payments, configuration, administration, and deployment.
- **External dependencies**: Libraries, services, parsers, cryptography, and the third parties behind them.
- **Failure & observability**: Error handling, logging, monitoring, exposure, recovery, and fail-open behavior.

## Choose what to review

- **Critical component**: Review a bounded service, library, client, agent, or subsystem with disproportionate impact.
- **Critical path**: Trace signing, authorization, settlement, recovery, or automation across repositories.
- **Release or change set**: Evaluate a major change, migration, integration, or security-sensitive diff in context.

## How we review your code.

1. **Build the threat model**: Agree repositories, target commits, and critical components. Map actors, inputs, trust boundaries, and dependencies that could expose sensitive data or actions.
2. **Trace critical paths and define invariants**: Follow authorization, privileges, and state changes through the code. Document the security properties each path must preserve.
3. **Review the code and write tests**: Manually examine failure paths and validate reachable flaws with targeted tests. Add regression tests to your repo and record the results against the invariants.
4. **Verify fixes and document conclusions**: Document affected code and remediation, always verify fixes through retesting, and record unresolved findings. Tie the principal’s signed opinion to the reviewed commit and evidence.

## Deliverables

- **Findings report**: Where the flaw sits in the code, what it lets someone do, and what to change.
- **Threat model**: Actors, trust boundaries, and attack scenarios, including those blocked by existing controls.
- **Record of flows and security properties tested**: Critical paths through inputs, authorization, and state changes, with the security properties each path must preserve.
- **Invariant register**: Each security property, its test result, and supporting evidence.
- **Security tests in your repo**: Regression tests alongside the code, so your engineers can verify fixes and check future changes.
- **Signed opinion on a reviewed commit**: The principal’s conclusions, tied to the reviewed commit, scope, and evidence.

## Engagement team

- **Timur Güvenkaya**, Founder & Partner: Rust-based and non-EVM systems, protocol security, architecture, infrastructure, and custody.
- **Piotr Cielas**, Principal Advisor: Financial-services assessments, offensive security, risk leadership, CVEs, and patents.
- **Łukasz Mikuła**, Specialist Advisor: Offensive security, exploit development, mobile, infrastructure, and multi-ecosystem reviews.

## Published reports

- [Jump DeFi: Backend & Frontend Security Assessment](https://github.com/Guvenkaya/public-reports/blob/master/Jump-Defi-Backend-And-Frontend-Security-Assessment.pdf)
- [Spin Finance: Onchain Orderbook and Perpetual Trading Security Review](https://github.com/Guvenkaya/public-reports/blob/master/Spin-NEAR-Rust-Smart-Contract-Security-Assessment.pdf)
- [NEAR Intents: NEAR Intents Passkeys Pull Request Security Review](https://github.com/Guvenkaya/public-reports/blob/master/NEAR-Defuse-Labs-NEAR-Intents-Passkeys-Pull-Request-Security-Review.pdf)

## Frequently asked questions

### Is this the same as running SAST?

No. Tools can support the work, but the service is a manual review of logic, trust boundaries, state, privilege, integrations, and exploitability.

### Which languages do you review?

Support depends on the assigned reviewers and codebase. We confirm languages, frameworks, build requirements, size, and critical components during scoping.

### What do you need to scope the review?

We need access to the code, alongside architecture documentation, build instructions, tests, critical workflows, your main concerns, and your deadline. We arrange secure repository access during scoping.

### Can you review one critical workflow?

Yes. A critical-path review can be more useful than uniform review when one flow controls funds, privileges, signing, settlement, or recovery.

### Should we combine this with a penetration test?

Combine them when both implementation depth and deployed attack-path validation matter.

### Can you work with a private repository?

Yes. The repository does not need to be public. We agree access and confidentiality requirements during scoping, including how to share code and documentation.

### How do you verify fixes?

We always provide remediation guidance and verify fixes. We review the changes and rerun the relevant tests or reproductions. The final report records the remediation status and any unresolved issues.

## Related services

- [Penetration Testing](https://www.guvenkaya.co/services/penetration-testing.md): Test the attack paths that connect web, mobile, APIs, cloud, identity, and infrastructure.
- [Smart Contract Security Reviews](https://www.guvenkaya.co/services/smart-contract-security-review.md): Find flaws in contract logic, permissions, accounting, and upgrades before they put funds at risk.
- [AI & Agent Security](https://www.guvenkaya.co/services/ai-agent-security.md): Review models, data, tools, memory, identity, permissions, approval gates, and high-impact actions.

## Show us the critical code.

Describe the codebase, critical workflow, and deadline. We will help define the review scope.

Discuss your scope: https://www.guvenkaya.co/contact