Manual and assisted source code review: dangerous sinks, injection patterns, authn/authz flaws, secrets, and insecure dependencies across major languages.
89 checks · progress and notes saved in your browser
How to approach a secure code review: threat-driven prioritization, data-flow and taint analysis, entry-point mapping, and the tooling that makes it repeatable.
Locate sinks where untrusted data is interpreted as code or commands: SQL, OS commands, file paths, deserialization, and template/eval execution.
Review authentication logic, access control enforcement, and session/token handling for missing or broken checks.
Find hardcoded secrets, weak or misused cryptography, and disabled certificate/TLS validation.
Review output encoding, server-side request handling, file uploads, and XML parsing for injection and SSRF sinks.
Review dependency risk, debug/configuration exposure, and language-specific footguns that lead to vulnerabilities.