TL;DR
When acquiring a codebase, rotate all credentials immediately, scan for hardcoded secrets in git history, audit dependencies for vulnerabilities, revoke access for previous developers, and review authentication patterns. 6 critical items must be done immediately, 9 important items within the first week, and 5 recommended items for thorough security. Trust nothing until verified.
Quick Checklist (5 Critical Items)
Credential Audit 5
Access Control 4
Dependency and Code Audit 5
Infrastructure Review 6
Treat Acquired Code as Untrusted
When you acquire a codebase, you are inheriting someone else's security decisions, mistakes, and technical debt. You have no visibility into how credentials were handled, who had access historically, or what shortcuts were taken.
A 2024 study by Synopsys found that 84% of codebases contained at least one known vulnerability, and 48% contained high-risk vulnerabilities. The older the codebase, the higher the likelihood of issues.
Should I rotate all credentials after acquiring a codebase?
Yes, always. You have no way of knowing who had access previously or if credentials were ever shared inappropriately. Rotating all credentials is the safest approach.
How do I find hardcoded secrets in an acquired codebase?
Use secret scanning tools like TruffleHog, GitLeaks, or GitHub's built-in secret scanning. Also manually search for common patterns like 'api_key', 'password', 'secret', and 'token' in the codebase. Do not forget to scan the entire git history, not just the current state.
How long should a security audit of acquired code take?
A basic security audit takes 4 to 8 hours for a small application. Larger applications may require days or weeks. Prioritize credential rotation and access revocation first, as these are the highest risk items.
Scan Your Acquired Codebase
Get an automated security assessment to identify vulnerabilities quickly.
Start Free Scan