Security-Focused Code Review Workflow
Add a security lens to reviews covering input handling, authorization, secrets, and injection surfaces.
Objective
Catch security issues during review before they reach production.
Environment
- A review checklist
- Threat context for the service
- Static analysis tooling
Steps
1. Check input handling
Review validation, encoding, and deserialization of untrusted input.
Expected state: Untrusted input is validated and encoded.
2. Check authorization
Confirm every sensitive operation enforces authentication and object-level authorization.
Expected state: No endpoint trusts the client for authorization.
3. Check secrets and injection
Look for hardcoded secrets and injection into queries, commands, or templates.
Expected state: Secrets are externalised and injection paths are parameterised.
4. Confirm with tooling
Run static analysis as a backstop, then confirm findings are addressed.
Expected state: Tooling and review agree the change is clean.
Decision points
Security review for every change?
- For sensitive surfaces
- Everything equally
Focus security review on auth, input, and secret handling changes.
Tooling or human review?
- Both
- Tooling only
Tooling catches patterns; humans catch logic; use both.
Expected outcome
Security-relevant defects are caught during review rather than after deployment.
Verification
Confirm the change enforces authorization, externalises secrets, and addresses static analysis findings.
Cleanup
Update the security checklist from any miss and share it with the team.
Overview
Catch security issues during review before they reach production.
This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.
Environment and prerequisites
- A review checklist
- Threat context for the service
- Static analysis tooling
Procedure
1. Check input handling
Review validation, encoding, and deserialization of untrusted input.
Expected state: Untrusted input is validated and encoded.
2. Check authorization
Confirm every sensitive operation enforces authentication and object-level authorization.
Expected state: No endpoint trusts the client for authorization.
3. Check secrets and injection
Look for hardcoded secrets and injection into queries, commands, or templates.
Expected state: Secrets are externalised and injection paths are parameterised.
4. Confirm with tooling
Run static analysis as a backstop, then confirm findings are addressed.
Expected state: Tooling and review agree the change is clean.
# scan the diff for common injection patterns
semgrep --config p/owasp-top-ten --diffVerification
Confirm the change enforces authorization, externalises secrets, and addresses static analysis findings.
Decision points
Security review for every change?
- For sensitive surfaces
- Everything equally
Recommendation: Focus security review on auth, input, and secret handling changes.
Tooling or human review?
- Both
- Tooling only
Recommendation: Tooling catches patterns; humans catch logic; use both.
Common failures
- Skipping authorization checks in review misses broken access control.
- Hardcoded secrets slip through without a lens.
- Tooling-only misses logic flaws.