Skip to content
-
Write a custom Semgrep rule to track a real taint path
When the codebase has a project-specific source or sink, a five-line taint rule finds every instance faster than reading files.
Source Code Review
-
Confirm authorization on GraphQL resolvers per field
Route-level auth misses GraphQL entirely; each resolver that returns sensitive data needs its own check.
Source Code Review
-
Verify webhooks and callbacks check signatures
Inbound webhook handlers that skip signature verification let anyone forge events like payment success.
Source Code Review
-
Find mass assignment in strongly-typed frameworks
Binders that map the whole request to a model let attackers set fields the form never exposed, like role or price.
Source Code Review
-
Review logging for sensitive data and log injection
Logging raw request data can leak secrets and lets attackers forge or break log lines with CRLF.
Source Code Review
-
Trace command injection through format strings
Any place a shell command is assembled from input with interpolation is injectable regardless of language.
Source Code Review
-
Check CORS and security headers set in code
A reflected Access-Control-Allow-Origin with credentials, set in application code, is a data-theft primitive.
Source Code Review
-
Find open redirects and unsafe forward targets
Redirects built from request parameters enable phishing and can bootstrap OAuth token theft.
Source Code Review
-
Detect catastrophic backtracking regular expressions
Nested quantifiers and overlapping alternations on user input cause exponential regex time and denial of service.
Source Code Review
-
Audit GitHub Actions for injection and privilege
pull_request_target with checkout of untrusted code, and expressions built from PR text, hand attackers your CI secrets.
Source Code Review