Secure Code Review
Review code for vulnerabilities systematically, not line-by-line.
1. Orient
- What does this code do? Identify: entry points, trust boundaries, data stores, privileged operations
- Read the tests — what invariants do they reveal?
- Check the diff's blast radius: auth logic? parsing? file handling? crypto?
2. Trace Untrusted Data
Follow each input from entry point to sink:
| Sink Class | What to Verify |
|---|---|
| SQL/NoSQL | Parameterized; no string-built queries; identifiers whitelisted |
| Command exec | No user data in shell strings; argv-array APIs; no shell=True |
| HTML/rendering | Contextual auto-escaping; raw/unsafe HTML flags justified |
| File paths | Basename/allowlist; canonicalize + prefix check; no user paths in includes |
| Deserialization | Typed formats (JSON) over object serializers; validation post-parse |
| Redirects | Relative-only or allowlisted targets |
| Eval/dynamic code | Justified and input-free, or rejected |
3. Audit Auth and Access Control
- Every endpoint enforces authz server-side; role checks at the resource, not the controller only
- Object-level checks (IDOR): does the query filter by the caller's tenant/user ID?
- Session management: rotation, invalidation, secure cookie flags
- Password reset flows: token entropy, expiry, single-use, no account enumeration
4. Audit Secrets and Config
- No hardcoded credentials/keys/API tokens; no secrets in logs or error messages
- Crypto: approved algorithms, library primitives (not hand-rolled), correct modes, random from CSPRNG
5. Race and State
- TOCTOU on file checks, check-then-use on quotas/credits
- Concurrency on mutable shared state; missing transactions on multi-step writes
Communication
Report findings with severity, the specific code path, an exploit sketch, and a suggested fix. Distinguish "must fix" from "harden later."