<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-code-review
description: >-
  Conduct systematic security-focused code reviews using checklists, automated
  assistants, and threat-informed analysis. Cover OWASP Top 10 categories,
  business logic flaws, and cryptographic misuse.
domain: cybersecurity
subdomain: devsecops
tags:
  - code-review
  - security-review
  - owasp
  - threat-analysis
  - pull-request
  - peer-review
  - business-logic
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Performing Security Code Review

## Overview

Security code review systematically examines source code for vulnerabilities that
automated tools miss — business logic flaws, race conditions, insecure design
patterns, and subtle authentication bypasses. This skill covers structured review
checklists, automated assistance, and PR-integrated security review workflows.

Mode: `[MODE: BLUE]` — Manual and assisted vulnerability detection through code review.

## Prerequisites

| Requirement | Details |
|---|---|
| Repository with pull request workflow | Required |
| OWASP Code Review Guide familiarity | Required |
| Language-specific security knowledge | Required |
| PR review permissions | Required |

## Key Concepts

### Security Review Checklist

```markdown
## Security Code Review Checklist

### Authentication & Session
- [ ] Password hashing uses bcrypt/argon2 with sufficient rounds
- [ ] Session tokens generated with CSPRNG
- [ ] Session timeout and rotation implemented
- [ ] Multi-factor authentication cannot be bypassed

### Authorization
- [ ] Every endpoint checks authorization before processing
- [ ] Object-level authorization enforced (no IDOR)
- [ ] Role checks cannot be bypassed via parameter manipulation
- [ ] Admin functions isolated from user functions

### Input Handling
- [ ] All user input validated on server side
- [ ] SQL queries use parameterized statements
- [ ] HTML output properly encoded/escaped
- [ ] File uploads validated (type, size, content)
- [ ] Deserialization of untrusted data avoided

### Cryptography
- [ ] No hardcoded keys or secrets
- [ ] TLS 1.2+ enforced for external calls
- [ ] Passwords hashed, never encrypted
- [ ] Random values use secrets module, not random

### Error Handling
- [ ] No stack traces in production responses
- [ ] Generic error messages for authentication failures
- [ ] Logging does not include sensitive data
- [ ] Failed operations do not leave inconsistent state
```

### Automated Review Annotations

```yaml
name: Security Review Assist
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  security-review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Diff analysis
        run: |
          git diff origin/main...HEAD -- '*.py' '*.js' '*.ts' > /tmp/diff.patch
      - name: Check for security-sensitive changes
        run: |
          PATTERNS="auth|password|token|session|encrypt|decrypt|hash|permission|role|admin"
          if grep -iP "$PATTERNS" /tmp/diff.patch; then
            echo "SECURITY_SENSITIVE=true" >> $GITHUB_ENV
          fi
      - name: Label PR
        if: env.SECURITY_SENSITIVE == 'true'
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: ['security-review-required']
            });
```

### CODEOWNERS for Security-Sensitive Paths

```
# .github/CODEOWNERS
/src/auth/          @security-team
/src/crypto/        @security-team
/src/middleware/     @security-team
/config/security/   @security-team
*.key               @security-team
*.pem               @security-team
```

### Review Comment Templates

```markdown
### 🔒 Security Finding

**Category**: [Authentication|Authorization|Input Validation|Crypto|Config]
**Severity**: [Critical|High|Medium|Low]
**CWE**: CWE-XXX

**Issue**: [Description of the vulnerability]

**Current code**:
\`\`\`python
# problematic code here
\`\`\`

**Suggested fix**:
\`\`\`python
# secure alternative here
\`\`\`

**References**: [OWASP link, CWE link]
```

## Workflow

### Step 1: Analyze PR for Security-Sensitive Changes

```bash
node scripts/agent.js --action analyze --diff /tmp/pr.patch --output /tmp/review.json
```

### Step 2: Generate Review Checklist

```bash
node scripts/agent.js --action checklist --source-dir ./src/ --output /tmp/checklist.json
```

### Step 3: Scan for Common Review Findings

```bash
node scripts/agent.js --action findings --source-dir ./src/ --output /tmp/findings.json
```

## Detection

```yaml
title: Security Code Review Detection
id: 7202eb72-cafc-4194-8656-02da58a95c97
status: experimental
description: Detects suspicious activity related to performing security code review techniques in devsecops context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*performing*security*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.execution
falsepositives:
  - CI/CD pipeline executing authorized security scanning tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Security Code Review Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] Security-sensitive PRs auto-labeled for security team review
- [ ] CODEOWNERS enforces security team approval on auth/crypto paths
- [ ] Review checklist used consistently
- [ ] Findings documented with CWE and severity
- [ ] Review coverage tracked as metric

## References

- [OWASP Code Review Guide](https://owasp.org/www-project-code-review-guide/)
- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [CWE/SANS Top 25](https://cwe.mitre.org/top25/)
