The agency said they ran a source code analysis for handover, what does that mean and is it necessary?

Static code analysis inspects the app's source code without running it, usually catching known security vulnerabilities, memory leaks, or non-standard code blocks. The agency should be able to provide the raw PDF report showing which tool was used to scan and the severity levels of the findings.

Correction: I misremembered the figure, it was a bit lower.

Did they deliver a written technical report following this analysis? Did they specify which standards they scanned against, like OWASP rules or was it just verbal?

Analyzing your own code and finding zero issues is a classic delivery defense. It's very likely they ran a free plugin and claimed they "analyzed" it just to justify the two-month delay. Ask for the report, they usually end up empty-handed.

You have 3 clear demands to send the agency right now: 1) Ask for the analysis output report in its raw form, 2) Get written confirmation that critical and high-severity vulnerabilities have been patched, 3) Add an agency liability annotation to the handover report for any unresolved medium-severity risks.

Last year, on our 350.000 TL budget B2B project, the agency claimed everything was clean. It didn't sit right with us, so we paid 35.000 TL for an independent third-party audit; 3 critical authorization vulnerabilities turned up. The agency had to patch them for free under the contract.

Send an email without wasting time. Ask for the dates of the tests run, the name of the scanning tool used, and the bug list generated if any. If it was part of their routine development, they already have the output on hand and can send it over today.

they told us the exact same thing when our delivery was delayed, and when we asked for a report they sent a generic two-page write-up. I mean make sure to demand detailed logs and scan output, dont let them brush it off.

On our own portal, the system locked up three months after delivery due to a database query error. Turns out when the agency said they "ran source code analysis", they just ran basic syntax checks and never touched architectural load tests. Ever since, I refuse to officially accept delivery of any software without seeing an independent external report.

My questions are cleared up, thanks. The biggest time-waster for us was not knowing who had the final say.

Hope this helps.

Saved. If you get three different answers on a topic, the question was asked wrong.

I'm also curious if anyone does it differently.

correct.

We've heard this a lot, but it never happened like that for us. Mistakes made on the meaning of source code analysis side are usually reversible but expensive.

This is my opinion I'm not claiming it's absolute truth.

There's a common mistake people make when doing this. Taking notes for two weeks yields better results than a six-month estimate.

If I were you, I'd go this route.

Let me summarize the topic, since several different answers were given. If code ownership isn't in the contract, you have no bargaining power when leaving.

If you're going this route, sort this out first. Solutions that work at a small scale collapse when you grow; I learned this late.

If you post the result here, it will help others too.

My question might sound amateurish, sorry about that. The biggest time-waster for us was not knowing who had the final say.

If I were you, I'd go this route.

I'm curious too.

Thanks a lot, I'll try it today.