COGICEO Audits de code source

Audits de code source is a manual and automated source code audit service provided by COGICEO. Auditors review all or part of a codebase, including its compilation or execution conditions, to identify vulnerabilities resulting from poor coding practices or logic errors. The audit process follows five steps: - Initial study to define code architecture and identify critical portions - Automated analysis of the full codebase to surface obvious security issues - Manual analysis of previously identified critical portions (e.g. authentication, sensitive data access, administrative actions) - Dynamic analysis when the provided code is functional, testing application robustness with unexpected input data - Recommendations for each weakness found, including implementation examples The service audits multiple programming languages including ASP/ASP.NET, C/C++, C#, Java, JavaScript/TypeScript, Kotlin, Lua, Objective-C/Swift, Perl, PHP, Python, Ruby, Shell/PowerShell, and SQL. Key areas reviewed include: - Overall architecture and critical component analysis - Manual review of critical components - Entry points and user content injection analysis - Authentication, session management, and permission robustness - Password storage and cryptographic mechanism review - Configuration review - Search for backdoors and hidden code not exposed to users - Sensitive data storage and access analysis - Verification of functional logging mechanisms The methodology used is based on the OWASP Application Security Verification Standard (ASVS).