Security6 min read

Secure Code Review

Review code for security vulnerabilities with a systematic checklist covering injection, auth, crypto, error handling, and supply chain risks.

code-reviewsecurityappsecsast

Secure code review is the practice of examining source code to find security vulnerabilities before they reach production. It combines automated SAST tools with human judgment to catch logic flaws tools miss.

Every PR should pass automated SAST. Human security reviews focus on logic, business rules, and architectural flaws that tools miss. Use a checklist to ensure consistency across reviewers.

Workflow

Run automated tools firstTools catch 70%+ of common vulnerabilities consistently and at scale-don't duplicate their work manually.
Review authentication and authorization logicAuth bypasses are logic flaws tools almost never catch.
Check input handling and output encodingEvery user-controlled value reaching a sink (SQL, HTML, shell) is an injection risk.
Audit cryptography and secret handlingCustom crypto and hardcoded secrets are perennial vulnerabilities.
Review error handling and loggingVerbose errors expose stack traces, DB schemas, and internal paths to attackers.

Output Format

SAST findings reviewed, auth logic verified, injection paths traced, crypto usage audited, error handling checked, security findings documented with severity.

Examples

Auth bypass: `app.get("/admin", adminMiddleware, handler)` - check middleware is actually applied and not bypassable via route prefix tricks

IDOR: `SELECT * FROM orders WHERE id = ${orderId}` - must be `WHERE id = $1 AND user_id = $2`, [orderId, req.user.id]`

Crypto: grep for `createHash("md5")` in auth code, `Math.random()` in token generation, `rejectUnauthorized: false` in HTTPS clients

Edge Cases & Gotchas

Race conditions in auth flows (TOCTOU): check time-of-check vs time-of-use in token validation and session management
Second-order injection: data stored safely but later used unsafely in another context (stored XSS, second-order SQL injection)
Dependency confusion: `npm install company-internal-package` may resolve to a malicious public package if registry not pinned

When to Break These Rules

For internal config files with no security impact, full security review adds friction without value-focus security review on code handling user input, auth, and sensitive data.

Reference Files

OWASP Code Review Guide: https://owasp.org/www-project-code-review-guide/
Semgrep registry: https://semgrep.dev/r
OWASP ASVS checklist: https://owasp.org/www-project-application-security-verification-standard/