<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-source-code-review
description: >-
  Static application security testing (SAST) using semgrep, CodeQL, Bandit,
  and manual review techniques to identify vulnerabilities in source code
  including hardcoded secrets, injection sinks, insecure cryptography, and
  unsafe deserialization patterns.
domain: cybersecurity
subdomain: application-security
tags:
  - source-code-review
  - sast
  - semgrep
  - codeql
  - bandit
  - owasp-a06
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059", "T1552.001"]
  owasp-top10: ["A06"]
  tools: ["semgrep", "codeql", "bandit", "gitleaks", "trufflehog"]
---

# Performing Source Code Review

## Overview

Source code review combines automated SAST tooling with manual analysis to
identify security vulnerabilities before deployment. Effective review targets
injection sinks, authentication logic, cryptographic misuse, hardcoded
secrets, and unsafe data handling patterns.

## Prerequisites

- Tools: semgrep, CodeQL CLI, Bandit (Python), gitleaks, trufflehog
- Source code repository access
- Language-specific rule packs installed

## Workflow

### Step 1: Automated SAST Scanning

```bash
# Semgrep with OWASP and auto rules
semgrep --config=auto --config=p/owasp-top-ten --config=p/security-audit \
  --json src/ | jq '.results[] | {path: .path, line: .start.line, rule: .check_id, severity: .extra.severity}'

# Semgrep for specific vulnerability classes
semgrep --config=p/sql-injection src/
semgrep --config=p/xss src/
semgrep --config=p/command-injection src/

# Bandit for Python projects
bandit -r src/ -f json -ll -ii

# CodeQL database creation and analysis
codeql database create codeql-db --language=javascript --source-root=src/
codeql database analyze codeql-db codeql/javascript-queries:Security \
  --format=sarif-latest --output=results.sarif
```

### Step 2: Secret Detection

```bash
# Gitleaks scan repository history
gitleaks detect --source=. --report-format=json --report-path=secrets.json

# Trufflehog scan for high-entropy strings
trufflehog git file://. --json --only-verified

# Semgrep secret rules
semgrep --config=p/secrets src/
```

### Step 3: Manual Review Targets

```bash
# Find authentication and authorization logic
rg -n 'authenticate|authorize|isAdmin|checkRole|verify_token' src/
rg -n 'password|secret|api_key|token' --type py src/

# Find dangerous function calls
rg -n 'eval\(|exec\(|system\(|popen\(|subprocess\.call' src/
rg -n 'innerHTML|document\.write|\.html\(|v-html' src/

# Find SQL query construction
rg -n 'execute\(.*%|execute\(.*format|execute\(.*\+|f".*SELECT' src/

# Find deserialization calls
rg -n 'pickle\.loads|yaml\.load\b|unserialize|readObject|JSON\.parse' src/

# Find file operations with user input
rg -n 'open\(.*request|file_get_contents|include\(.*\$|require\(.*\$' src/
```

### Step 4: Triage and Prioritize

```bash
# Semgrep with severity filtering
semgrep --config=auto --severity=ERROR src/ --json | \
  jq '[.results[] | {rule: .check_id, file: .path, line: .start.line}] | length'

# Generate SARIF for IDE integration
semgrep --config=auto --output=results.sarif --sarif src/
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Hardcoded secrets pushed | Git hooks | Pre-commit gitleaks detection |
| SAST findings ignored | CI/CD | Failed security gates in pipeline |
| Dangerous function usage | Code review | eval/exec/system in new commits |

```yaml
title: Source Code Review Detection
id: 4f55b9ba-c93b-4d10-949e-356acfd404f2
status: experimental
description: Detects suspicious activity related to performing source code review techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1059
  - attack.t1552.001
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] SAST scan completed with zero critical findings or documented exceptions
- [ ] Secret scanning shows no exposed credentials
- [ ] Manual review of authentication and authorization logic completed
- [ ] All injection sinks validated for proper sanitization
- [ ] SARIF report generated for tracking

## References

- [Semgrep Rules Registry](https://semgrep.dev/explore)
- [CodeQL Documentation](https://codeql.github.com/docs/)
- [OWASP Code Review Guide](https://owasp.org/www-project-code-review-guide/)
