Is this okay!? How to review code for security issues. You've got some code from a team member to review. You already know that security is important, but do you know how to review their code for security issues? In this session, Rouan will equip you to find common security issues before they're shipped to production. He’ll cover eight questions you should ask yourself whenever you’re reviewing code. We’ll look at an example pull request together and spot some big security issues that could easily have gone unnoticed.

1. Is this okay!?
Rouan Wilsenach
Engineering Lead, Haven
@rouanw
Reviewing code for security issues

6. Too much
pressure
Code reviews are great for
catching issues but they can’t be
the only thing.
- Build awareness 💬
- Threat modelling 🐉
- Pen testing 🔦
- SAST 🖥

7. Where’s the input
going?
- Is there new input?
- Have we changed the way
input is handled?
- Where it’s stored?
- How it’s used later?
1 .

9. Are the right AAA
checks in place?
- Authentication - have we
checked the actor is who
they say they are?
- Authorisation - have we
checked they’re allowed to
do this?
- Auditing - have we made a
note of what happened?
2 .

10. Principle of
least privilege

11. Have the assets
changed?
● Do we have consent and
legitimate interest?
● Are we storing any
personal or special
information? E.g.
○ PII
○ Special Category
○ Criminal Offence
3 .

12. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/

13. Are you leaking
data?
- Is your API returning extra
bits?
- Are you logging stuff you
shouldn’t?
- Don’t keep anything you
don’t need
4 .

15. Any new
dependencies?
Do some research on new
dependencies. Are they:
- Trusted
- Popular
- Well maintained
- Do you really need it?
5 .

17. https://snyk.io/advisor/

18. Has the config
changed?
- Misconfiguration is a super
common cause of security
issues
- If your config isn’t code,
you can’t review it!
6 .

20. Is anything being
cached?
- Don’t show one user’s
sensitive info to another!
- Everyone should
understand the default
cache behaviour
- Good cache keys
7 .

21. Have you checked
the borders?
Handy trick if you’re short on
time is to focus on where data
enters and leaves your system -
e.g. where a web request comes
in and where we talk to a
database.
8 .

22. Bonus! #9
More than one
mistake from a
security issue
https://blog.codinghorror.com/falling-into-the-pit-of-success/

23. A few tricks that
helped me learn
Find your
security
mentor
Turn up at
post
mortems
Smashing
Security
Podcast
Offer help
during pen
tests
Find a
security
course
online

24. 1 .
2 .
3 .
4 .
5 .
6 .
7 .
8 .
Inputs
AAA
Asset type
Data leaks
Dependencies
Boundaries
Config
Caching
Reviewing code for security issues – Cheat Sheet
@rouanw