Standard Classification: How To Review Code For Vulnerabilities
summary
The session gives concrete review steps: use an IDE with global and regex search, run quick terminal scripts, and combine SAST SCA and secret‑scanners. Demo searches surface aws access keys and an eval command injection and tracing an orderstatus.java call reveals a SQL injection plus logging of credit card data. Claims manual review plus automated scanners finds both obvious hard‑coded secrets and subtler data‑flow bugs.
AI-written summary · about
chapters (8)
- 0:00Start
- 2:36Most application security issues are derived from insecure coding practices.
- 5:09Prep: Get the tools right.
- 7:34How to prepare for a security code review: Concepts
- 10:03Prep: Study up on vulnerabilities.
- 10:40Prep: Understand the application.
- 11:59Quick start hunting
- 13:34Tarpit Java
related talks
44mFind security vulnerabilities through code review
01h 24mCode Red: Navigating the Minefield of Security Programming Blunders
40mIs Your Code Secure?: Automatic Security Analysis Tools and Systems
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities
27mHow to Start Security Testing Without Fear
52mDevSecOps
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants