Secure Code Review
Review code for vulnerabilities systematically, not line-by-line.
1. Orient
- What does this code do? Identify: entry points, trust boundaries, data stores, privileged operations
- Read the tests — what invariants do they reveal?
- Check the diff's blast radius: auth logic? parsing? file handling? crypto?
2. Trace Untrusted Data
Follow each input from entry point to sink:
3. Audit Auth and Access Control
- Every endpoint enforces authz server-side; role checks at the resource, not the controller only
- Object-level checks (IDOR): does the query filter by the caller's tenant/user ID?
- Session management: rotation, invalidation, secure cookie flags
- Password reset flows: token entropy, expiry, single-use, no account enumeration
4. Audit Secrets and Config
- No hardcoded credentials/keys/API tokens; no secrets in logs or error messages
- Crypto: approved algorithms, library primitives (not hand-rolled), correct modes, random from CSPRNG
5. Race and State
- TOCTOU on file checks, check-then-use on quotas/credits
- Concurrency on mutable shared state; missing transactions on multi-step writes
Communication
Report findings with severity, the specific code path, an exploit sketch, and a suggested fix. Distinguish "must fix" from "harden later."
