DevSecOps Practice Hub

Security Code Review

Apply targeted human review to the changes where automation is weakest: authorisation, business logic and cryptography.

IntermediateCode ReviewApplication

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Code Static analysis, secret detection and secure coding practices.

Overview

Scanners are good at pattern-matching and poor at intent. Security review focuses reviewer attention on authorisation decisions, tenant isolation, state transitions and cryptographic use.

Why it matters

Broken access control is consistently among the most impactful application weaknesses and is almost invisible to static analysis.

How it works

  1. 01CODEOWNERS routes sensitive paths to reviewers with security context.
  2. 02A short checklist prompts for authorisation and data-exposure questions.
  3. 03Findings are captured as rules where possible so they do not recur.

Common tools

GitHubGitLabSemgrepGitHubGitLab

Implementation examples

textRoute sensitive paths to security reviewers
# CODEOWNERS/src/auth/**        @acme/security/src/payments/**    @acme/security @acme/payments/infra/**           @acme/platform
Review requirements become part of the repository configuration rather than convention.

Best practices

  • Keep changes small.
  • Require review on security-sensitive paths.
  • Timebox and checklist the review.

Common mistakes

  • Reviewing everything with the same depth, so nothing gets real attention.