Security Review

Purpose

Find the vulnerabilities in a codebase or a change, with enough specificity that each finding can be fixed and verified. A security review that produces a list of theoretical concerns is not a security review.

When to Use

• Reviewing a pull request that touches authentication, authorization, or user input.
• Auditing a service before it becomes internet-facing.
• Responding to a penetration-test report.
• Periodic review of a security-sensitive codebase.

Capabilities