2025
2024
Security Posture
Spotting Injection Vulnerabilities in Code Review
How to find SQL injection, command injection and XSS during code review by tracing sources to sinks, with vulnerable and fixed code examples.
Security Posture
Secrets Management: Getting Credentials Out of Your Code
A practical guide to secrets management: move credentials into a vault, use short-lived secrets and OIDC federation, scan repos, rotate keys and handle leaks.
Security Posture
Making Secure Code Review Part of Every Pull Request
How to build security into your pull request workflow: CODEOWNERS, PR templates, automated checks and risk-based triggers that don't slow developers down.
Security Posture
Code Review for Authentication and Authorization Flaws
How to review code for broken authentication and access control: missing checks, IDOR, weak sessions and token handling, with questions to ask on every pull request.
Security Posture
Reviewing Third-Party Dependencies: Supply Chain Risk in Secure Code Review
Third-party dependencies are code you didn't write but still ship. Learn what to check in a secure code review of new and updated packages.
Security Posture
A Practical Secure Code Review Checklist for Development Teams
A practical secure code review checklist: what to check for input handling, authentication, authorization, secrets, cryptography, logging and dependencies.
2023
Security Posture
How to Build a Secure Code Review Program That Developers Will Actually Use
A step-by-step guide to building a secure code review program: goals, risk tiers, tooling, training, metrics and a feedback loop that keeps improving.
Vulnerability Management
Using SBOMs to Find Vulnerable Components Faster
Learn how to use an SBOM to find vulnerable components faster: generate SBOMs, store them centrally, match them against vulnerability data and apply VEX.
Security Posture
Finding Business Logic Flaws in Code Review
Business logic flaws slip past scanners because the code works as written. Learn how to find them in code review by asking what should never happen.
Security Posture
API Security: Protecting the Connections Between Your Systems
An API security guide for IT teams: the OWASP API Security Top 10 2023, API inventory, object-level authorization, rate limiting, gateways, schemas and testing.
Security Posture
Reviewing Cryptography Code: Common Mistakes to Catch
The most common cryptography mistakes in application code, from weak password hashing to predictable random numbers, and how to spot them in review.
Security Posture
Manual vs. Automated Secure Code Review: What Each One Finds
Static analysis tools and human reviewers find different problems. Compare manual and automated secure code review and learn how to combine them.
Security Posture
Hardcoded Secrets in Source Code: How Code Review Catches Them
Hardcoded credentials in source code are easy to commit and hard to fully remove. Learn how to catch them in review, rotate them and stop them recurring.
Vulnerability Management
Securing Your Open-Source Dependencies
How to secure open-source dependencies with SCA, lockfiles, update bots, OpenSSF Scorecard and SLSA, and how to handle malicious packages and license risk.
2020