TRUST BOUNDARIES · SINKS · SECRETS

Secure Code Review Checklist

Review dangerous APIs, authentication and authorization decisions, cryptography, injection sinks, and secret handling before code reaches production.

ASSESSMENT FOCUS

What this checklist covers

  • Dangerous APIs, deserialization, file, process, and network operations
  • Authentication, session handling, and server-side authorization
  • Injection sinks for SQL, HTML, commands, templates, and paths
  • Cryptographic algorithms, key handling, and random values
  • Secrets, logs, error paths, and secure defaults

REFERENCE BASELINE

Standards and guidance

  • OWASP ASVS
  • CERT Secure Coding
  • CWE

Tailor every control to the system's architecture, data classification, threat model, and written scope.

Open the interactive checklist

Search controls, filter by severity, expand technical guidance, and keep progress in your browser.

Start assessment →

How to use it professionally

Before testing

Confirm authorization, scope, exclusions, test windows, data handling, emergency contacts, and stop conditions.

During testing

Record the asset, request, expected control, observed result, evidence, and any cleanup action. Avoid destructive proof when a safer validation demonstrates the same issue.

After testing

Deduplicate related symptoms, identify the root cause, assign risk in business context, provide actionable remediation, and retest the final implementation.