Security Code Review Checklist to find Security Vulnerabilities

Security code review checklists can help developers focus on security vulnerability and privacy issues. A security-focused mindset is important, as we can see a shift left in the security field. This means that developers nowadays have to know more about security than ever. But, do you know the OWASP Top 10, or the CWE Top 25 by heart?

No? Well, no problem. That’s why code review checklists are so powerful. That’s why I have prepared a security code review checklist for you.

In this security code review checklist, I walk you through the most important points, such as data and input validation, authentication and authorization, as well as session management and encryption.

Research is very clear on the power of code review checklists. Code reviewers who use a code review checklist outperform code reviewers that don’t. In addition, code review checklists make it clear what a team finds important to look at during code reviews. A code review checklist can be part of defining your team standards and your coding standard. I’m sure this code review checklist is valuable to you and helps you to boost your code review effectiveness.

Download the Secure Code Review Checklist

You can find the complete security code review checklist on GitHub. In addition, check out my general code review checklist here, which lists all important aspects you should consider during code review.

Screenshot of the security code review checklist

If you fancy, you can also watch the OWASP DevSlop episode where I talk about finding security issues in code reviews.

You can also download my slides below. Ah, and if you are interested in the vulnerable code for the code review example, you can find it here: https://github.com/mgreiler/code-reviews

You can download the slides for my talk by clicking on the image.

Every two weeks, I send an email packed with code review tips or also handy checklists and cheat sheets, as well as updates on my entrepreneurial journey to my loyal email community. Maybe you fancy joining?

I want in!

Powered by EmailOctopus

Dr. Michaela Greiler

I make code reviews your superpower.

One thought on “Security Code Review Checklist to find Security Vulnerabilities

  • February 9, 2021 at 17:26
    Permalink

    Great advice! Do you know if any tools incorporate these checklists? Might be an interesting addition…

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *