Secure Code Review Cheat Sheet¶

Introduction¶

Secure Code Review is the process of manually examining source code to identify security vulnerabilities that automated tools often miss. It involves analyzing application logic, data flow, and implementation details to detect security flaws that require human expertise and contextual understanding.

Manual Code Review complements automated security testing tools (SAST/DAST) by focusing on areas where human analysis provides the most value, including business logic validation, complex security implementations, and context-specific vulnerabilities. While automated tools can assist by highlighting potential areas of concern, the core analysis relies on human judgment and domain expertise.

Security-Focused Review differs from functional code review by specifically targeting security concerns such as input validation, authentication mechanisms, authorization controls, cryptographic implementations, and potential attack vectors.

Review Types¶

Baseline Reviews examine the entire codebase comprehensively. Use for:

New applications or major releases
Legacy system onboarding
Compliance requirements
Post-incident analysis

Diff-Based Reviews focus on code changes only. Use for:

Pull requests and commits
Daily development workflow
Feature completion
Continuous security validation

This cheat sheet provides practical guidance for conducting effective manual security code reviews, with emphasis on both baseline and incremental review methodologies.

Review Methodology¶

Preparation¶

For All Reviews:

Understand application architecture and business requirements
Gather threat models and previous security findings
Identify critical assets and high-risk functions
Review security requirements and documentation

Additional for Baseline Reviews:

Map complete application boundaries and dependencies
Analyze overall security architecture
Review security incident history
Audit all third-party libraries

Additional for Diff-Based Reviews:

Identify modified files and affected components
Assess impact on existing security controls
Understand purpose of changes
Prioritize high-risk modifications

Review Process¶

Baseline Review Steps:

Architecture review for security anti-patterns
Entry point analysis and input validation
Authentication and authorization verification
Data flow tracing
Business logic analysis
Cryptographic implementation review
Error handling verification
Configuration and deployment review

Diff-Based Review Steps:

Analyze impact on existing security controls
Identify new attack vectors
Verify security at modified trust boundaries
Check new integrations
Ensure no security regression
Apply relevant security patterns

Common Vulnerability Patterns¶

Input Validation Vulnerabilities¶

Check for missing server-side validation, improper sanitization, and weak input filtering. For more information, see Input Validation Cheat Sheet.

Injection Vulnerabilities¶

SQL Injection:

Look for string concatenation in database queries and unsafe query construction. For more information, see SQL Injection Prevention Cheat Sheet.

Cross-Site Scripting (XSS):

Review output encoding, DOM manipulation, and user input rendering. For more information, see Cross Site Scripting Prevention Cheat Sheet.

Path Traversal:

Check for unsafe file path construction and directory traversal vulnerabilities. For more information, see File Upload Cheat Sheet.

Command Injection:

Identify direct command execution with user input and unsafe system calls. For more information, see OS Command Injection Defense Cheat Sheet.

NoSQL Injection:

Examine NoSQL query construction and parameter binding. For more information, see NoSQL Security Cheat Sheet.

Authentication & Session Management Vulnerabilities¶

Review authentication mechanisms, session token generation, and user credential handling. For more information, refer to Authentication Cheat Sheet and Session Management Cheat Sheet.

Access Control Vulnerabilities¶

Examine authorization checks, role-based access controls, and privilege escalation prevention. For more information, see Authorization Cheat Sheet.

Deserialization Vulnerabilities¶

Insecure Deserialization:

Check for unsafe deserialization of untrusted data and object injection vulnerabilities. For more information, see Deserialization Cheat Sheet.

XML External Entity (XXE):

Review XML parsing configurations and external entity processing. For more information, see XML External Entity Prevention Cheat Sheet.

Cryptographic Implementation Flaws¶

Examine encryption algorithms, key management, and cryptographic implementations. For more information, refer to Cryptographic Storage Cheat Sheet.

Review Techniques¶

Code Pattern Analysis¶

Focus on high-risk code patterns:

Input processing and validation functions
Database query construction and ORM usage
File operations and path handling
Authentication and session management logic
Authorization and access control checks
Cryptographic operations and key management
Error handling and logging mechanisms
Configuration loading and environment variables

Data Flow Analysis¶

Trace data through the application:

Identify Sources: User inputs, file uploads, API calls, database reads, environment variables
Follow Processing: Validation, transformation, business logic, caching
Check Sinks: Database queries, file writes, output rendering, logging, external APIs
Validate Boundaries: Input validation and output encoding at trust boundaries
Trust Zones: Verify security controls at each trust boundary crossing
Data Classification: Ensure sensitive data receives appropriate protection

Threat-Based Review¶

Align review with common attack patterns:

OWASP Top 10: Focus on prevalent web application risks
STRIDE Model: Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation
Attack Trees: Map potential attack paths through the application
Abuse Cases: Consider how features could be misused by attackers
Security Controls: Verify defense-in-depth implementation

Business Logic Review¶

Analyze application workflows for:

State management and transition validation
Race conditions and concurrency issues
Transaction integrity and rollback mechanisms
Resource limits and quota enforcement
Authorization at each workflow step
Workflow bypass opportunities

Review Checklists¶

Input Validation¶

[ ] Server-side validation: All inputs validated on server regardless of client-side checks
[ ] Allowlist validation: Uses allowlists rather than blocklists for input validation
[ ] Output encoding: Context-appropriate encoding (HTML, JavaScript, CSS, URL, SQL)
[ ] File upload security: Content-based validation, size limits, safe storage
[ ] SQL injection prevention: Parameterized queries or stored procedures used
[ ] Length limits: Input length restrictions enforced
[ ] Character handling: Special characters and Unicode properly processed
[ ] Error messages: No sensitive information disclosed in error responses

Authentication & Session Management¶

[ ] Password security: Strong hashing algorithms and salt usage (for more information, see Password Storage Cheat Sheet)
[ ] Account protection: Lockout mechanisms with appropriate thresholds
[ ] Session management: Secure token generation (≥128 bits entropy)
[ ] Session lifecycle: Proper invalidation on logout/timeout
[ ] Re-authentication: Required for sensitive operations
[ ] Multi-factor authentication: Implementation for high-risk accounts (for more information, see Multifactor Authentication Cheat Sheet)
[ ] Password reset: Secure, time-limited reset mechanisms (for more information, see Forgot Password Cheat Sheet)
[ ] Session security: HttpOnly, Secure, SameSite cookie attributes
[ ] Concurrent sessions: Appropriate limits and monitoring

Authorization¶

[ ] Server-side enforcement: All access controls enforced server-side
[ ] Fail-safe defaults: Default deny access policy
[ ] IDOR prevention: Proper authorization for resource access
[ ] Function-level controls: Administrative functions properly protected
[ ] Role validation: Role assignments cannot be manipulated
[ ] Privilege escalation: Horizontal and vertical escalation prevented
[ ] Centralized decisions: Access control logic centralized
[ ] Post-authentication checks: Authorization verified after authentication

Cryptography¶

[ ] Strong algorithms: Modern algorithms (AES-256, RSA-2048+, ECDSA P-256+)
[ ] Key management: Proper key generation, storage, and rotation (for more information, see Key Management Cheat Sheet)
[ ] Certificate validation: Proper validation including hostname verification
[ ] Random generation: Cryptographically secure random number generation
[ ] Data protection: Encryption at rest and in transit
[ ] IV/Nonce handling: Unique and unpredictable initialization vectors
[ ] Library maintenance: Up-to-date cryptographic libraries
[ ] Side-channel protection: Consideration of timing and other side-channel attacks

Business Logic¶

[ ] Workflow integrity: Proper state validation in multi-step processes
[ ] Race condition prevention: Synchronization in concurrent operations
[ ] Transaction atomicity: Proper rollback and consistency mechanisms
[ ] Resource limits: Rate limiting and resource quotas implemented
[ ] Business rule enforcement: Cannot bypass rules through direct API access

Configuration & Deployment¶

[ ] Secure defaults: Security-focused default configurations
[ ] Environment separation: Proper isolation between environments
[ ] Secrets management: No hardcoded secrets, proper secret storage and rotation (for more information, see Secrets Management Cheat Sheet)
[ ] Error handling: Graceful error handling without information disclosure (for more information, see Error Handling Cheat Sheet)
[ ] Logging security: Sensitive data not logged, proper log protection (for more information, see Logging Cheat Sheet)
[ ] Security headers: Appropriate HTTP security headers configured (for more information, see HTTP Headers Cheat Sheet)
[ ] TLS configuration: Strong cipher suites and protocol versions (for more information, see Transport Layer Security Cheat Sheet)
[ ] Dependency management: Up-to-date libraries without known vulnerabilities (for more information, see Vulnerable Dependency Management Cheat Sheet)

Security Monitoring¶

[ ] Security events: Authentication failures, authorization violations logged
[ ] Anomaly detection: Unusual patterns and behaviors monitored
[ ] Audit trails: Complete audit logs for sensitive operations
[ ] Real-time alerts: Critical security events trigger immediate notifications
[ ] Log integrity: Logs protected from tampering and unauthorized access
[ ] Incident response: Clear procedures for security incident handling

Tools and Techniques¶

Code Editors¶

Use editors with security extensions:

Visual Studio Code with ESLint, SonarLint
IntelliJ IDEA with SpotBugs, SonarLint
Eclipse with security plugins
Vim/Neovim with security linters

Command-Line Pattern Detection¶

# Find hardcoded secrets
grep -ri "password\s*=\|api_key\s*=\|secret\s*=" source/

# Find unsafe functions
grep -r "eval(\|exec(\|innerHTML\|document\.write" source/

# Find potential injections
grep -r "SELECT.*+\|executeQuery.*+" source/

Manual Review Focus Areas¶

Human Expertise Advantages:

Business Logic Flaws: Complex workflows and state management issues that require domain understanding
Context-Specific Vulnerabilities: Security issues that depend on application-specific business rules
Authorization Logic: Complex permission models and access control implementations
Race Conditions: Timing-based vulnerabilities in concurrent operations
Cryptographic Misuse: Proper implementation of cryptographic primitives and protocols
Architecture Security: High-level design flaws and security anti-patterns

Manual Analysis Techniques:

Code Path Tracing: Following execution paths through complex business logic
State Analysis: Understanding application state transitions and validation
Trust Boundary Mapping: Identifying and analyzing security control points
Threat Modeling Integration: Applying threat models to specific code implementations
Attack Scenario Simulation: Mentally simulating attack paths through the code

Automated Tool Integration¶

Supporting Manual Reviews:

SAST Tool Triage: Use automated findings to prioritize manual review areas
Dependency Scanning: Identify vulnerable libraries requiring manual assessment
Code Quality Metrics: Focus manual effort on complex or frequently changed code
Pattern Detection: Use tools to highlight potential security anti-patterns for human analysis

Tool Integration Strategy:

Pre-Review Scanning: Run automated tools before manual review to identify obvious issues
Complementary Analysis: Use tool findings to guide deeper manual investigation
False Positive Filtering: Apply human judgment to validate automated findings
Coverage Gaps: Focus manual review on areas automated tools cannot effectively analyze

Security Metrics:

Manual Review Coverage: Percentage of critical code paths reviewed by humans
Finding Quality: Ratio of valid security issues to total findings
Review Efficiency: Time spent on manual review vs. security value delivered
Trend Analysis: Security posture improvement over time

Documentation Templates¶

Finding Report Template:

Title: [Vulnerability Type] in [Component]
Severity: [Critical/High/Medium/Low]
CWE: [CWE Number and Name]
Location: [File:Line or Function]
Description: [Detailed explanation of the vulnerability]
Impact: [Security implications and potential attack scenarios]
Reproduction: [Steps to reproduce or proof of concept]
Recommendation: [Specific fix guidance with code examples]
References: [CWE links, OWASP references, vendor documentation]
Status: [Open/In Progress/Fixed/Accepted Risk]
Assignee: [Developer responsible for fix]
Due Date: [Target fix date]

Review Summary Template:

Review Summary
==============
Application: [Application Name]
Version: [Version/Commit Hash]
Reviewer(s): [Names]
Review Date: [Date]
Scope: [Files/Components Reviewed]

Findings Summary:
- Critical: [Count]
- High: [Count] 
- Medium: [Count]
- Low: [Count]
- Informational: [Count]

Key Recommendations:
1. [Priority recommendation]
2. [Priority recommendation]
3. [Priority recommendation]

Overall Risk Assessment: [Low/Medium/High/Critical]

Integration with SDLC¶

Review Timing¶

Baseline Review Integration¶

Project Initiation: Comprehensive security assessment of existing codebase
Major Releases: Full security review before significant version releases
Architecture Changes: Complete review when fundamental design changes occur
Compliance Cycles: Periodic comprehensive reviews for regulatory requirements
Security Incidents: Thorough review following security breaches or major vulnerabilities
Onboarding Legacy Systems: Initial security assessment when bringing existing applications under secure development practices

Diff-Based Review Integration¶

Pull Requests: Security-focused review of code changes as part of standard PR process
Pre-commit Hooks: Lightweight security checks on developer commits
Feature Completion: Security review of completed user stories or features
Sprint Reviews: Regular assessment of security implications of sprint deliverables
Hotfix Reviews: Rapid security assessment of emergency fixes
Continuous Integration: Automated triggering of security reviews based on code changes

Hybrid Approach¶

Risk-Based Scheduling: Combine baseline reviews for high-risk components with diff-based reviews for routine changes
Incremental Baseline Updates: Gradually expand baseline review coverage over multiple development cycles
Trigger-Based Reviews: Escalate from diff-based to baseline review when significant security concerns are identified

For CI/CD integration and automated security testing, for more information see CI CD Security Cheat Sheet.

Team Collaboration¶

Roles:

Security reviewers: Conduct analysis and provide guidance
Developers: Implement fixes and follow secure coding practices
Security champions: Bridge security and development teams

Best Practices:

Use standardized checklists and templates
Maintain a knowledge base of common issues
Track metrics on review effectiveness
Provide regular security training
Integrate with existing development workflows

Advanced Techniques¶

Race Condition Analysis¶

Focus on Time-of-Check vs Time-of-Use (TOCTOU) vulnerabilities and ensure atomic operations.

Business Logic Analysis¶

Analyze workflows for:

State transitions and validation
Opportunities to bypass steps or validation
Proper validation at each workflow step
Rollback mechanisms and cleanup on failures
Behavior under concurrent access
Boundary conditions and error scenarios

Security Architecture Review¶

Review architecture patterns for consistent security enforcement and proper API security controls.

Memory Safety¶

Review buffer management, integer overflow protection, and resource limits.

References¶

OWASP Resources:

Related OWASP Cheat Sheets:

Industry Standards:

Additional Resources: