We took over code left by an agency — how should a secure code review be done, and where do we start?

Your first urgent priority should be purging the Git history. Even if you remove the credentials from the codebase and commit the change, those keys remain exposed forever in the commit log. Scan the entire history with open-source secret-scanning tools, rewrite the history to purge the secrets, and rotate those passwords on the servers immediately.

Have your developer run your package manager's built-in security audit command first thing tomorrow. Libraries sitting untouched for two years almost certainly have dozens of published CVEs. Simply bumping dependencies to their latest stable releases will instantly knock out half of your exposure.

We ran static code analysis on a 30k-line project we inherited last year. The tool flagged 142 potential alerts; after our developer reviewed them, 8 turned out to be real vulnerabilities that could have led directly to a database leak. Patching those 8 flaws took us just three days.

Don't rely too much on automated analysis tools; you could easily drown in hundreds of false positives across a thousands-of-lines-long report. The biggest data leaks don't stem from library vulnerabilities, but from simple session control oversights where the agency dev thought "no one's gonna try that anyway." Focus heavily on manual business logic testing.

an agency that hardcodes passwords prolly didn't even look at the file upload part either... test immediately if someone can sneak in an executable php file while uploading customer docs that's the most dangerous backdoor.

Document the identified findings in a formal security risk matrix. Categorize the vulnerabilities as critical, high, and medium. Keeping the system live and accessible to customers before resolving critical vulnerabilities that directly threaten database and customer confidentiality may lead to serious legal liabilities.

Go back and review your contract with the agency. Most contracts contain an explicit or implicit warranty clause stating that the code will be delivered in accordance with industry standards and basic security practices. Hardcoding passwords into the source code is a clear defect of service; you may have the legal right to serve the agency with a formal notice to fix it.

how do static code analysis tools inspect the code without actually running it? i mean how exactly can these tools tell that a function has a vulnerability without deploying it to a live server or connecting to a database?

I have no experience with secure code review, so I'm asking. Everything goes well for the first three months; problems arise in the fourth.

Start with a small trial; don't commit to everything at once. If you have questions, write them; I'll answer as best I can.

i'm curious too.

This approach has a cost which isn't discussed. If 2FA is on, a stolen password alone is useless.

If you have questions, write them; I'll answer as best I can.

I was thinking the same thing. An automated scan report is not the same as a penetration test.

If I were you, I'd go this route.

I went through the same thing. When we decide without measuring, we always end up in the same place.

That's all, sorry if I went on too long.

I was thinking the same thing. If 2FA is on, a stolen password alone is useless.

Solutions that work at a small scale collapse when you grow; I learned this late. Just leaving this note, it might be useful.

there are three things to check when doing this and people defend habits, not processes. btw resistance comes from there.

Im in the same situation, thats why Im asking. anyway if permission and scope arent in writing, dont start that test.

Processes without records never improve, because you dont know what to fix. btw this is my opinion Im not claiming its absolute truth.

The opposite happened to me, that's why I'm writing. Mistakes made on the secure code review side are usually reversible but expensive.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

My questions are cleared up, thanks. Your time to detect an issue directly determines its cost.

If you have questions, write them; I'll answer as best I can.