Source Code Security Review

Quick Start

1. Identify - languages, frameworks, package managers present
2. Automated SAST - run tools appropriate to the stack
3. Dependency CVEs - scan lockfiles/manifests for known CVEs
4. Secrets scan - detect hardcoded credentials/tokens
5. Manual review - trace high-risk sinks (exec, eval, query, deserialize)
6. Malicious code - check for backdoors, obfuscation, suspicious network calls
7. Report - findings with CWE/CVE refs, severity, PoC, remediation

Workflow