Skip to content
-
Grep git history and CI for leaked secrets
A rotated secret still lives in history; scan commits, not just the current tree.
Source Code Review
-
Review .NET for BinaryFormatter and typed serializers
BinaryFormatter, LosFormatter, and type-permissive JSON settings are direct RCE in .NET applications.
Source Code Review
-
Review Ruby for send, YAML.load, and mass assignment
Dynamic send on user input, YAML or Marshal load, and permit! are the highest-yield Ruby and Rails findings.
Source Code Review
-
Review Go for command and template injection
exec with sh -c, and text/template used where html/template is required, are the two classic Go review findings.
Source Code Review
-
Spot TOCTOU and check-then-act races in code
Balance checks, file existence checks, and uniqueness checks that are separate from the action are exploitable windows.
Source Code Review
-
Find JWT verification that trusts the token
Decode-without-verify, accepting alg none, and hardcoded secrets are the three JWT review killers.
Source Code Review
-
Catch insecure randomness for security tokens
Session ids, reset tokens, and API keys generated from non-cryptographic RNGs are predictable.
Source Code Review
-
Flag weak cryptography and password hashing
MD5 or SHA1 for passwords, ECB mode, and static IVs are review red flags that indicate broader crypto misuse.
Source Code Review
-
Verify XML parsers disable external entities
An XML parser is XXE-safe only if external entities and DTDs are explicitly disabled at construction.
Source Code Review
-
Audit SQL construction for concatenation and raw ORM
Parameterized queries are safe; string building and raw ORM escapes are where injection hides.
Source Code Review