Harbor Artificial Contact
Menu Close

Code & AppSec · S-CODE-1

Secure Code Review (SAST + manual)

Expert eyes on your riskiest code paths.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Compare 3 tiers Book a call

Pricing

Compare tiers

Pay the deposit to start. Pay the final balance before handoff.

Starter

$1,800

Hours. 14 hours

Scope. 1 repo, ≤25k LOC, 1 primary language

Deliverables

  • Findings report, CVSS 4.0-scored, top-risk walkthrough call (30 min)

Turnaround. 5 business days

Pay deposit ($900) (opens Stripe in a new tab) Pay final balance ($900) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Standard

$3,400

Hours. 28 hours

Scope. ≤2 repos, ≤75k LOC total, ≤2 languages

Deliverables

  • Findings report, threat notes for auth/data paths, 60-min walkthrough

Turnaround. 8 business days

Pay deposit ($1,700) (opens Stripe in a new tab) Pay final balance ($1,700) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Advanced

$5,600

Hours. 46 hours

Scope. ≤3 repos, ≤150k LOC total, ≤3 languages

Deliverables

  • Findings report, data-flow notes, secure-coding guidance per team, 90-min walkthrough

Turnaround. 12 business days

Pay deposit ($2,800) (opens Stripe in a new tab) Pay final balance ($2,800) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Retest included: Starter, one retest of Critical and High findings within 30 days; Standard, one retest of all findings within 45 days; Advanced, two retests within 60 days. Another round is the Extra Retest add-on.

Scope

Deliverables, limits, and standards

Standards mapping

OWASP Top 10:2025; CWE IDs per finding; OWASP ASVS 5.0 references where relevant; NIST SSDF SP 800-218 v1.1 (PW.7 code review); NIST CSF 2.0 PR.PS / ID.RA.

Exclusions

  • Live/dynamic testing
  • generated/vendored code beyond LOC cap
  • binaries
  • mobile platform internals
  • fixing code (see S-FIX)

Acceptance

Every finding has file+line evidence, CWE, CVSS 4.0 vector or a stated reason for qualitative severity, and a remediation step; LOC count reproduced with cloc/scc and stated in report.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Book a call All security services

More in Code & AppSec

Not sure this tier is the one?

Email [email protected] with the system you want reviewed. We will point at a tier in this catalog, or tell you if the work is outside it.

Book a call All security services