1.
Is this okay!?
Rouan Wilsenach
Engineering Lead, Haven
@rouanw
Reviewing code for security issues

2.
Too much
pressure
Code reviews are great for
catching issues but they can’t be
the only thing.
- Build awareness 💬
- Threat modelling 🐉
- Pen testing 🔦
- SAST 🖥

3.
Where’s the input
going?
- Is there new input?
- Have we changed the way
input is handled?
- Where it’s stored?
- How it’s used later?
1 .

4.
Are the right AAA
checks in place?
- Authentication - have we
checked the actor is who
they say they are?
- Authorisation - have we
checked they’re allowed to
do this?
- Auditing - have we made a
note of what happened?
2 .

5.
Principle of
least privilege

6.
Have the assets
changed?
● Do we have consent and
legitimate interest?
● Are we storing any
personal or special
information? E.g.
○ PII
○ Special Category
○ Criminal Offence
3 .

7.
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/

8.
Are you leaking
data?
- Is your API returning extra
bits?
- Are you logging stuff you
shouldn’t?
- Don’t keep anything you
don’t need
4 .

9.
Any new
dependencies?
Do some research on new
dependencies. Are they:
- Trusted
- Popular
- Well maintained
- Do you really need it?
5 .

10.
https://snyk.io/advisor/

11.
Has the config
changed?
- Misconfiguration is a super
common cause of security
issues
- If your config isn’t code,
you can’t review it!
6 .

12.
Is anything being
cached?
- Don’t show one user’s
sensitive info to another!
- Everyone should
understand the default
cache behaviour
- Good cache keys
7 .

13.
Have you checked
the borders?
Handy trick if you’re short on
time is to focus on where data
enters and leaves your system -
e.g. where a web request comes
in and where we talk to a
database.
8 .

14.
Bonus! #9
More than one
mistake from a
security issue
https://blog.codinghorror.com/falling-into-the-pit-of-success/

15.
A few tricks that
helped me learn
Find your
security
mentor
Turn up at
post
mortems
Smashing
Security
Podcast
Offer help
during pen
tests
Find a
security
course
online

16.
1 .
2 .
3 .
4 .
5 .
6 .
7 .
8 .
Inputs
AAA
Asset type
Data leaks
Dependencies
Boundaries
Config
Caching
Reviewing code for security issues – Cheat Sheet
@rouanw