Is this okay!? How to review code for security issues
summary
A checklist of eight questions for secure code review that flags concrete issues: a new PUT endpoint on an Express app introduces missing authorization and a mass assignment risk, returns excess fields (data leakage), and adds a sensitive sexual orientation field requiring GDPR review. Demonstrates using tests to expose problems, recommends dependency scanning (npm audit, Sneak Advisor) and treating configuration, caching and logging as reviewable code, and advocates defense-in-depth so one mistake never causes a breach.
AI-written summary · about
chapters (10)
- 0:00Start
- 3:14Npm Audit Helper
- 6:52Cross-Site Scripting
- 7:02The Right Triple A Checks
- 8:11Principle of Least Privilege
- 9:30Special Category Data
- 12:19Supply Chain Attacks
- 14:26Misconfiguration
- 15:01Secure Code Review
- 18:31Too Many Pull Requests
related talks
44mFind security vulnerabilities through code review
27mHow to Start Security Testing Without Fear
28mStandard Classification: How To Review Code For Vulnerabilities
38mFinding Security Issues in Open Source
58mIncoherent Code: How Code Quality Impacts Security
08mAPI Security Risks
19mCritical Security Mistakes in Frontend Applications
20mConducting Humane Code Reviews