# Secure Code Review
We read existing .NET codebases line-by-line and
produce remediation reports mapped to OWASP Top 10
and ITSG-33 controls. Findings are prioritized by
exploitability and business impact, not raw severity.
- Executive summary (non-technical, for sponsors)
- Findings register (CVE-style entries with CWE mappings)
- Remediation guidance (specific code changes, not generic advice)
- Re-test report after fixes
- Full codebase review
- Pre-release security gate
- Third-party module audit
- Incident-driven targeted review
Fixed-scope engagements. Typical turnaround 2-6
weeks depending on codebase size.
- methodology.cs
- secure-dev.md