Source Code Review

CoinFabrik’s cyber security professionals perform a variety of code audits.

Source code review is the process of auditing a source code to discover security flaws, bugs and vulnerabilities in applications. The process entails a comprehensive analysis and structured review of the source code to spot the glitches that might compromise the software’s security and functionality. Working with highly analytical, detail oriented, and solutions driven code auditors is the secret to having a successful audit. Our seasoned team is familiar with all modern application auditing processes and techniques.

Automatic vs Manual

The automatic code review is done by tools that look for common source code vulnerabilities. These automatic tools are certainly fast, but are not recommended for in-depth audits. Manual audits are comprehensive and can be applied to all programming languages thus most preferable.

Static vs Dynamic

Static source code analysis is done when the program is not in operation. This makes it possible to identify malicious codes and coding flaws. Dynamic review is performed during the program’s runtime. The latter monitors the overall program performance, including response time and functionality. Both methods are important and complement each other.

Black box vs White box

The difference between black box and white box review is the amount of source code information given to the tester or reviewer. In a black box review, the analysis is done blindly without access to the source code. Applicable techniques for a black box review include reverse engineering and penetration testing. A white box review, on the other hand, is done with full access to the source code. Normal secure code reviews are done using the white box method.

Internal vs External

An internal code review is done by members of the organization during the development process while an external code review is done by an outsourced team. The external review team is fully independent and gives a complete outsider point of view. Both review methods are crucial and complement each other.