Secure Code Review
Code review is the highest-leverage security skill, because it finds bugs before they ship. This exercise gives you a method you can apply to any codebase: follow untrusted input, know the risky sinks worth searching for, hunt hardcoded secrets, and turn what you find into a clear, fixable report.
Log in or create a free account to submit keys and track your progress.
What you will learn
- Apply a repeatable source-to-sink reading method to any codebase
- List the risky sinks worth grepping for first
- Explain why hardcoded secrets are a critical finding
- Write a security finding a developer can actually act on
Before you start
These exercises cover what this one builds on.
- SQL Injection: Code Review Medium
In this exercise
- Why read the code at all
- The method: follow the input
- Grep for the risky sinks
- Hunt for secrets
- Write a finding people can act on
🔒
This is a Pro exercise
Pro unlocks every exercise, the written solutions, the video walkthroughs and badge certificates. Free exercises stay free.
See Pro plans Create a free account5 sections · 2 keys · 50 points