One of my friend’s company wanted to do a full security assessment of their code base, does anyone have any suggestions or recommendations?

I know a security consultant, let me know if you'd like to talk to him. He's pretty experienced and has done work for Apollo hospitals, Flipkart, etc.

Sure, please get me in touch with him.