☰   How to use this guide

Secure code review is one discipline: follow the data. A SAST tool flags candidates; a finding is real only when you trace an untrusted source (HTTP param, header, body, file, DB, queue, IPC, env) to a dangerous sink (exec, query, eval, deserialize, file op, redirect) with no effective sanitisation between them. This guide turns every checklist line into what-to-grep + how-to-confirm. Pair with the dynamic checklists (web/API/mobile) to prove exploitability.

# Breadth pass, then trace by hand
semgrep --config p/owasp-top-ten --config p/secrets .
# Map sources/sinks quickly with ripgrep
rg -n --no-heading -e 'request\.|req\.(query|body|params)|\$_(GET|POST|REQUEST)|getParameter' .   # sources
rg -n --no-heading -e 'exec|system|eval|query\(|innerHTML|deserialize|readObject|unserialize' .   # sinks

0   Prep & approach

Get the whole codebase and config, understand the architecture and trust boundaries, and map sources, sinks and the enforcement points for auth/authz before diving in.

Prep & approach — full coverage

1   Authentication (code)

Look for missing checks, plaintext/non-constant-time compares, weak hashing, hardcoded creds, and logic that grants access without verifying the password.

rg -n -e 'md5|sha1\(' -e 'password\s*==' -e '==\s*password' -e 'hardcoded|backdoor'
rg -n -e 'if\s*\(\s*user\s*!=\s*null' -e 'verify.*=.*true'      # auth-bypass logic smells
# JWT: secret + verification
rg -n -e 'jwt|alg.*none|verify\(|decode\('

Authentication (code) — full coverage

2   Authorization (code)

The big one: ownership and role checks. Find queries using a user-supplied ID without an ownership filter, missing role guards, and mass assignment.

# Object access without ownership filter (IDOR/BOLA in code)
rg -n -e 'findById|getById|where.*id|params\.id|req\.params'      # then check ownership filter exists
# Missing role guards / mass assignment
rg -n -e '@PreAuthorize|@Authorize|hasRole|isAdmin'              # presence/absence on sensitive fns
rg -n -e 'bind\(|@ModelAttribute|mass.?assign|update\(req\.body|create\(req\.body'

Authorization (code) — full coverage

3   Session management (code)

Session rotation, invalidation, cookie flags and identifier entropy — in the framework's session config and login/logout handlers.

Session management (code) — full coverage

4   Injection (source → sink)

Trace each source to each sink. String-built SQL, command exec, eval, deserialize, template render, and XML parsing of untrusted data are the high-severity hits.

# SQL string concat (vs parameterized)
rg -n -e 'SELECT .*\+|format.*SELECT|f".*SELECT|query\(.*\$\{|\.raw\('
# Command / code execution on input
rg -n -e 'exec\(|system\(|popen|Runtime\.exec|child_process|shell=True|eval\(|Function\('
# Deserialization
rg -n -e 'readObject|unserialize|pickle\.loads|yaml\.load\b|Marshal\.load|BinaryFormatter'
# XXE: parser without hardening
rg -n -e 'DocumentBuilderFactory|SAXParser|XmlReader|libxml|etree'

Injection — full coverage

5   Output encoding / XSS (code)

Find user data reaching a browser sink without encoding, and disabled auto-escaping.

rg -n -e 'innerHTML|dangerouslySetInnerHTML|v-html|document\.write'
rg -n -e '\|\s*safe|\{\{\{|Html\.Raw|mark_safe|autoescape\s*(off|false)'

Output encoding / XSS — full coverage

6   Cryptography (code)

Weak algorithms, ECB, static keys/IVs, non-CSPRNG and trust-all TLS — grep the crypto API usage.

rg -n -e 'DES|RC4|MD5|SHA1|ECB|Math\.random|new Random\(|InsecureSkipVerify|verify=False|trustAllCerts'

Cryptography (code) — full coverage

7   Secrets management (code)

Hardcoded keys, secrets in config/comments/history. Scan the working tree and the full git history.

trufflehog git file://. ; gitleaks detect --source .
rg -n -e 'api[_-]?key|secret|password|BEGIN (RSA|PRIVATE) KEY|AKIA[0-9A-Z]{16}'
git log -p -S 'password' | head            # secrets that were committed then removed

Secrets management (code) — full coverage

8   Error handling & logging (code)

Verbose errors to users, sensitive data in logs, swallowed exceptions and fail-open paths.

Error handling & logging — full coverage

9   File handling (code)

Path from user input without canonicalisation, unrestricted uploads, and unsafe archive extraction.

rg -n -e 'new File\(|open\(|fopen|readFile|sendFile|include\(|require\(' # + check input canonicalization
rg -n -e 'getOriginalFilename|move_uploaded_file|MultipartFile|extractall|ZipEntry'

File handling (code) — full coverage

10   Business logic (code)

Server-side re-validation, atomicity on financial ops, race conditions, and trusting client-supplied price/amount.

Business logic (code) — full coverage

11   Dependencies / supply chain

Known-vuln versions, untrusted sources, typosquats and build scripts running untrusted code.

npm audit ; pip-audit ; osv-scanner -r . ; trivy fs .   # depending on stack

Dependencies / supply chain — full coverage

12   Configuration & hardening

Insecure framework defaults, CORS, missing headers/CSRF, disabled TLS verification, permissive permissions.

rg -n -e 'cors|Access-Control-Allow-Origin|debug\s*=\s*true|csrf.*disable|verify\s*=\s*False|chmod 777'

Configuration & hardening — full coverage

13   Memory safety (C / C++ / unmanaged)

C/C++/unmanaged only: unbounded copies, missing bounds checks, integer overflow, UAF and format strings.

rg -n -e '\bstrcpy\b|\bstrcat\b|\bsprintf\b|\bgets\b|\bmemcpy\b'
rg -n -e 'printf\s*\(\s*[a-zA-Z_]'      # format string: printf(user_input)

Memory safety (C/C++) — full coverage

L   Language-specific gotchas

Match these to the stack — the dangerous sinks and framework footguns per language.

What to grep, by language

C   Category-specific review

Tailor the review to the component type — the same source→sink discipline, focused on what matters per layer.

By component — full coverage

✓   Coverage map & how to review

Review sections 0–12 on every codebase, §13 only for C/C++/unmanaged, and apply the language gotchas that match the stack.

Core principle: code review is follow the data, don't just scan. SAST flags candidates; a finding is real only when you trace an untrusted source to a dangerous sink with no effective sanitisation between. Prioritise injection, auth/authz gaps, deserialization and hardcoded secrets — and confirm exploitability (or mark it for dynamic confirmation) rather than reporting raw scanner output.