Code Security Review
Overview
Performs comprehensive security code reviews to identify vulnerabilities, assess security risks, and provide actionable remediation guidance. Covers OWASP Top 10, CWE classifications, compliance requirements, and security best practices.
Security Review Workflow
1. Initial Assessment
Gather context about the application:
- Application type: Web app, API, mobile, desktop, embedded
- Data sensitivity: PII, financial data, healthcare records, proprietary information
- Compliance requirements: PCI-DSS, GDPR, HIPAA, SOC 2, ISO 27001
- Authentication mechanisms: OAuth, JWT, session-based, API keys
- Technology stack: Languages, frameworks, libraries, databases
- External integrations: Third-party APIs, cloud services, payment processors
Perform threat modeling:
- Identify critical assets (data, functions, resources)
- Map attack surfaces (user inputs, APIs, file uploads, network interfaces)
- Determine threat actors (external attackers, malicious insiders, automated bots)
- Assess existing security controls
2. Code Analysis
Systematically review code for security vulnerabilities:
Priority Areas:
- Authentication & Authorization - Login flows, session management, access controls
- Input Validation - All user inputs, API parameters, file uploads
- Data Protection - Encryption at rest and in transit, sensitive data handling
- API Security - Rate limiting, authentication, input validation
- Dependency Security - Third-party libraries, outdated packages, known CVEs
- Configuration - Security headers, CORS, environment variables, secrets management
- Error Handling - Information disclosure, stack traces, error messages
- Business Logic - Race conditions, workflow bypasses, state manipulation
3. Vulnerability Classification
Classify each finding:
- Severity: Critical, High, Medium, Low, Informational
- CWE ID: Common Weakness Enumeration identifier
- OWASP Category: Map to OWASP Top 10 if applicable
- CVSS Score: Calculate if applicable (use CVSS 3.1)
- Exploitability: How easy to exploit
- Impact: Data loss, privilege escalation, DoS, data breach
4. Documentation
Produce comprehensive security report:
- Executive Summary - High-level findings and risk overview
- Detailed Findings - Each vulnerability with code examples and exploit scenarios
- Remediation Guidance - Specific fixes with secure code examples
- Compliance Assessment - Status against required standards
- Remediation Timeline - Prioritized action plan
- Security Metrics - Vulnerability counts by severity and category
Severity Classification
Critical (CVSS 9.0-10.0):
- Remote code execution
- Authentication bypass
- SQL injection with data access
- Hardcoded credentials for production systems
- Complete access control bypass
High (CVSS 7.0-8.9):
- Privilege escalation
- Sensitive data exposure (PII, financial)
- Cross-site scripting (XSS) with session theft
- Insecure deserialization
- XML external entity (XXE) injection
Medium (CVSS 4.0-6.9):
- Information disclosure
- Cross-site request forgery (CSRF)
- Weak cryptography
- Security misconfiguration
- Missing security headers
Low (CVSS 0.1-3.9):
- Version disclosure
- Verbose error messages
- Missing best practices
- Security through obscurity
Informational:
- Recommendations for defense in depth
- Future-proofing suggestions
- Security hygiene improvements
Report Structure
Generate security reports in this format:
Executive Summary
- Total vulnerabilities by severity
- Critical risk areas
- Compliance status summary
- Overall security posture rating
- Recommended immediate actions
Detailed Findings
For each vulnerability:
## [SEVERITY] Finding Title (CWE-XXX)
**Severity**: Critical/High/Medium/Low
**CWE ID**: CWE-XXX
**OWASP**: A0X:YYYY
**CVSS Score**: X.X (if applicable)
**Description**:
[Clear explanation of the vulnerability]
**Location**:
- File: path/to/file.ext
- Lines: XX-XX
- Function/Class: function_name()
**Vulnerable Code**:[Actual vulnerable code snippet]
**Exploit Scenario**: [Step-by-step demonstration of how an attacker could exploit this]
**Impact**: [What could happen if exploited - data breach, privilege escalation, etc.]
**Remediation**: [Specific steps to fix the vulnerability]
**Secure Code Example**:
[Working secure implementation]
**References**:
- [Relevant CWE, CVE, or documentation links]
Remediation Timeline
- Phase 1 (Critical - Week 1): List of critical issues
- Phase 2 (High - Weeks 2-3): List of high severity issues
- Phase 3 (Medium - Month 2): List of medium severity issues
- Phase 4 (Low - Month 3): List of low severity issues
Compliance Assessment
For each applicable standard, document:
- Requirements checked
- Compliance status (Compliant/Non-Compliant/Partially Compliant)
- Specific gaps identified
- Remediation needed for compliance
Detailed References
For comprehensive vulnerability patterns, testing procedures, and compliance details:
- OWASP Top 10 & CWE Patterns: See security-review-workflow.md for:
- Detailed vulnerability patterns for each OWASP Top 10 category - Code examples of vulnerable and secure implementations - Testing procedures and detection methods - Complete CWE mappings and classifications
- Security Testing Procedures: See security-testing-checklist.md for:
- Comprehensive testing checklist by category - Manual and automated testing techniques - Security testing tools and configurations - API security testing procedures
- Compliance Requirements: See compliance-requirements.md for:
- PCI-DSS requirements and validation - GDPR data protection requirements - HIPAA security and privacy rules - SOC 2 security controls
- Report Examples: See report-example.md for:
- Complete security report template - Example findings with remediation guidance - Executive summary examples - Remediation timeline structures
Best Practices
Be Thorough:
- Review ALL user input points
- Check ALL database queries
- Verify ALL authentication and authorization checks
- Test ALL file operations and uploads
- Examine ALL external integrations
Be Practical:
- Prioritize by risk (likelihood × impact)
- Consider exploitability and business context
- Account for compensating controls
- Balance security with usability
Be Clear:
- Provide step-by-step exploit scenarios
- Show exact vulnerable code locations
- Give specific, actionable remediation steps
- Include working secure code examples
Be Professional:
- Focus on code issues, not developers
- Use industry-standard classifications (CWE, OWASP, CVSS)
- Provide credible references (NIST, OWASP, vendor documentation)
- Document assumptions and testing limitations