Skip to content

Secure Code Review Cheat Sheet / 安全代码审查速查表

Introduction / 介绍

Secure Code Review is the process of manually examining source code to identify security vulnerabilities that automated tools often miss. It involves analyzing application logic, data flow, and implementation details to detect security flaws that require human expertise and contextual understanding.

安全代码审查是指手动检查源代码以识别自动化工具通常遗漏的安全漏洞的过程。它涉及分析应用程序逻辑、数据流和实现细节，以检测需要人类专业知识和情境理解的安全缺陷。

Manual Code Review complements automated security testing tools (SAST/DAST) by focusing on areas where human analysis provides the most value, including business logic validation, complex security implementations, and context-specific vulnerabilities. While automated tools can assist by highlighting potential areas of concern, the core analysis relies on human judgment and domain expertise.

手动代码审查通过专注于人类分析提供最大价值的领域来补充自动化安全测试工具（SAST/DAST），包括业务逻辑验证、复杂的安全实现和特定情境的漏洞。虽然自动化工具可以通过突出潜在的关注区域提供帮助，但核心分析依赖于人类判断和领域专业知识。

Security-Focused Review differs from functional code review by specifically targeting security concerns such as input validation, authentication mechanisms, authorization controls, cryptographic implementations, and potential attack vectors.

以安全为重点的审查与功能代码审查不同，它专门针对安全关注点，如输入验证、身份验证机制、授权控制、加密实现和潜在的攻击向量。

Review Types / 审查类型

Baseline Reviews examine the entire codebase comprehensively. Use for:

基线审查全面检查整个代码库。适用于：

  • New applications or major releases
    中文：新应用程序或重大版本发布
  • Legacy system onboarding
    中文：旧系统上线
  • Compliance requirements
    中文：合规要求
  • Post-incident analysis
    中文：事件后分析

Diff-Based Reviews focus on code changes only. Use for:

基于差异的审查仅关注代码更改。适用于：

  • Pull requests and commits
    中文：拉取请求和提交
  • Daily development workflow
    中文：日常开发工作流程
  • Feature completion
    中文：功能完成
  • Continuous security validation
    中文：持续安全验证

This cheat sheet provides practical guidance for conducting effective manual security code reviews, with emphasis on both baseline and incremental review methodologies.

这份速查表提供了进行有效手动安全代码审查的实用指导，侧重于基线和增量审查方法。

Review Methodology / 审查方法

Preparation / 准备

For All Reviews:

所有审查的通用内容:

  • Understand application architecture and business requirements
    中文：理解应用架构和业务需求
  • Gather threat models and previous security findings
    中文：收集威胁模型和以往的安全发现
  • Identify critical assets and high-risk functions
    中文：识别关键资产和高风险功能
  • Review security requirements and documentation
    中文：审查安全需求和文档

Additional for Baseline Reviews:

基准审查的额外内容:

Additional for Diff-Based Reviews:

针对基于差异的审查的附加内容:

  • Identify modified files and affected components
    中文：识别已修改的文件和受影响的组件
  • Assess impact on existing security controls
    中文：评估对现有安全控制的影响
  • Understand purpose of changes
    中文：理解变更的目的
  • Prioritize high-risk modifications
    中文：优先处理高风险修改

Review Process / 审查流程

Baseline Review Steps:

基线审查步骤:

  1. Architecture review for security anti-patterns
    中文：安全反模式架构审查
  2. Entry point analysis and input validation
    中文：入口点分析和输入验证
  3. Authentication and authorization verification
    中文：身份验证和授权验证
  4. Data flow tracing
    中文：数据流追踪
  5. Business logic analysis
    中文：业务逻辑分析
  6. Cryptographic implementation review
    中文：密码学实现审查
  7. Error handling verification
    中文：错误处理验证
  8. Configuration and deployment review
    中文：配置和部署审查

Diff-Based Review Steps:

基于差异的审查步骤:

  1. Analyze impact on existing security controls
    中文：分析对现有安全控制的影响
  2. Identify new attack vectors
    中文：识别新的攻击向量
  3. Verify security at modified trust boundaries
    中文：验证修改后的信任边界的安全性
  4. Check new integrations
    中文：检查新的集成
  5. Ensure no security regression
    中文：确保没有安全回归
  6. Apply relevant security patterns
    中文：应用相关安全模式

Common Vulnerability Patterns / 常见漏洞模式

For request forgery and redirect checks, also consult the CSRF Prevention, SSRF Prevention, and Unvalidated Redirects and Forwards cheat sheets.

对于请求伪造和重定向检查，也请参考CSRF预防、SSRF预防和未经验证的重定向和转发速查表。

Input Validation Vulnerabilities / 输入验证漏洞

Check for missing server-side validation, improper sanitization, and weak input filtering. For more information, see Input Validation Cheat Sheet and Mass Assignment Cheat Sheet.

检查是否存在服务器端验证缺失、不当清理和弱输入过滤。更多信息，请参阅输入验证速查表和大量赋值速查表。

Injection Vulnerabilities / 注入漏洞

SQL Injection:

SQL注入：

Look for string concatenation in database queries and unsafe query construction. For more information, see SQL Injection Prevention Cheat Sheet.

在数据库查询中寻找字符串连接和查询构造不安全的情况。更多信息，请参阅SQL注入防护备忘单。

Cross-Site Scripting (XSS):

跨站脚本(XSS)：

Review output encoding, DOM manipulation, and user input rendering. For more information, see Cross Site Scripting Prevention Cheat Sheet.

检查输出编码、DOM操作和用户输入渲染。更多信息，请参阅跨站脚本防护备忘单。

Path Traversal:

路径遍历：

Check for unsafe file path construction and directory traversal vulnerabilities. For more information, see File Upload Cheat Sheet.

检查不安全的文件路径构造和目录遍历漏洞。更多信息，请参阅文件上传备忘单。

Command Injection:

命令注入：

Identify direct command execution with user input and unsafe system calls. For more information, see OS Command Injection Defense Cheat Sheet.

识别直接使用用户输入执行命令和不安全的系统调用。更多信息，请参阅操作系统命令注入防御备忘单。

NoSQL Injection:

NoSQL注入：

Examine NoSQL query construction and parameter binding. For more information, see NoSQL Security Cheat Sheet.

检查NoSQL查询构造和参数绑定。更多信息，请参阅NoSQL安全速查表。

Authentication & Session Management Vulnerabilities / 身份验证与会话管理漏洞

Review authentication mechanisms, session token generation, and user credential handling. For more information, refer to Authentication Cheat Sheet and Session Management Cheat Sheet.

审查身份验证机制、会话令牌生成和用户凭证处理。更多信息，请参考身份验证速查表和会话管理速查表。

Access Control Vulnerabilities / 访问控制漏洞

Examine authorization checks, role-based access controls, and privilege escalation prevention. For more information, see Authorization Cheat Sheet.

检查授权检查、基于角色的访问控制和权限提升预防。更多信息，请参阅授权速查表。

Deserialization Vulnerabilities / 反序列化漏洞

Insecure Deserialization:

不安全的反序列化：

Check for unsafe deserialization of untrusted data and object injection vulnerabilities. For more information, see Deserialization Cheat Sheet.

检查对不受信任数据的非安全反序列化和对象注入漏洞。更多信息，请参阅反序列化速查表。

XML External Entity (XXE):

XML外部实体（XXE）:

Review XML parsing configurations and external entity processing. For more information, see XML External Entity Prevention Cheat Sheet.

审查XML解析配置和外部实体处理。更多信息，请参阅XML外部实体预防备忘单。

Cryptographic Implementation Flaws / 加密实现缺陷

Examine encryption algorithms, key management, and cryptographic implementations. For more information, refer to Cryptographic Storage Cheat Sheet.

检查加密算法、密钥管理和加密实现。更多信息，请参考加密存储备忘单。

Review Techniques / 审查技术

Code Pattern Analysis / 代码模式分析

Focus on high-risk code patterns:

关注高风险代码模式：

  • Input processing and validation functions
    中文：输入处理和验证函数
  • Database query construction and ORM usage
    中文：数据库查询构建和ORM使用
  • File operations and path handling
    中文：文件操作和路径处理
  • Authentication and session management logic
    中文：身份验证和会话管理逻辑
  • Authorization and access control checks
    中文：授权和访问控制检查
  • Cryptographic operations and key management
    中文：加密操作和密钥管理
  • Error handling and logging mechanisms
    中文：错误处理和日志机制
  • Configuration loading and environment variables
    中文：配置加载和环境变量

Data Flow Analysis / 数据流分析

Trace data through the application:

追踪应用程序中的数据:

  1. Identify Sources: User inputs, file uploads, API calls, database reads, environment variables
    中文：识别来源: 用户输入、文件上传、API调用、数据库读取、环境变量
  2. Follow Processing: Validation, transformation, business logic, caching
    中文：跟踪处理过程: 验证、转换、业务逻辑、缓存
  3. Check Sinks: Database queries, file writes, output rendering, logging, external APIs
    中文：检查输出点: 数据库查询、文件写入、输出渲染、日志记录、外部API
  4. Validate Boundaries: Input validation and output encoding at trust boundaries
    中文：验证边界: 在信任边界处进行输入验证和输出编码
  5. Trust Zones: Verify security controls at each trust boundary crossing
    中文：信任区域: 验证每个信任边界跨越处的安全控制
  6. Data Classification: Ensure sensitive data receives appropriate protection
    中文：数据分类: 确保敏感数据获得适当的保护

Threat-Based Review / 基于威胁的审查

Align review with common attack patterns:

与常见攻击模式对齐审查：

  • OWASP Top 10: Focus on prevalent web application risks
    中文：OWASP Top 10：关注普遍的Web应用风险
  • STRIDE Model: Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation
    中文：STRIDE模型：欺骗、篡改、否认、信息泄露、DoS、提升权限
  • Attack Trees: Map potential attack paths through the application
    中文：攻击树：映射应用中的潜在攻击路径
  • Abuse Cases: Consider how features could be misused by attackers
    中文：滥用案例：考虑攻击者可能如何误用功能
  • Security Controls: Verify defense-in-depth implementation
    中文：安全控制：验证多层次防御的实施

Business Logic Review / 业务逻辑审查

Use the Abuse Case Cheat Sheet to identify misuse scenarios.

使用滥用案例速查表来识别误用场景.

Analyze application workflows for:

分析应用程序工作流程：

  • State management and transition validation
    中文：状态管理和转换验证
  • Race conditions and concurrency issues
    中文：竞态条件和并发问题
  • Transaction integrity and rollback mechanisms
    中文：事务完整性和回滚机制
  • Resource limits and quota enforcement
    中文：资源限制和配额执行
  • Authorization at each workflow step
    中文：每个工作流程步骤的授权
  • Workflow bypass opportunities
    中文：工作流程绕过机会

Review Checklists / 审查清单

Input Validation / 输入验证

  • Server-side validation: All inputs validated on server regardless of client-side checks
    中文：[ ] 服务器端验证: 所有输入均在服务器端进行验证，无论客户端是否有检查
  • Allowlist validation: Uses allowlists rather than blocklists for input validation
    中文：[ ] 白名单验证: 使用白名单而不是黑名单进行输入验证
  • Output encoding: Context-appropriate encoding (HTML, JavaScript, CSS, URL)
    中文：[ ] 输出编码: 根据上下文适当的编码（HTML、JavaScript、CSS、URL）
  • File upload security: Content-based validation, size limits, safe storage
    中文：[ ] 文件上传安全: 基于内容验证、大小限制、安全存储
  • SQL injection prevention: Parameterized queries or safely implemented stored procedures used, with user-controlled data values passed as parameters instead of concatenated into SQL
    中文：[ ] SQL注入预防: 使用参数化查询或安全实现的存储过程（更多信息，请参阅 SQL注入预防速查表），将用户控制的数据值作为参数传递，而不是将其连接到SQL语句中
  • Length limits: Input length restrictions enforced
    中文：[ ] 长度限制: 实施输入长度限制
  • Character handling: Special characters and Unicode properly processed
    中文：[ ] 字符处理: 正确处理特殊字符和Unicode
  • Error messages: No sensitive information disclosed in error responses
    中文：[ ] 错误信息: 错误响应中不泄露敏感信息

Authentication & Session Management / 身份验证与会话管理

  • Password security: Strong hashing algorithms and salt usage (for more information, see Password Storage Cheat Sheet
    中文：[ ] 密码安全: 使用强散列算法和盐的使用（更多信息，请参阅 密码存储速查表
  • Account protection: Lockout mechanisms with appropriate thresholds
    中文： 账户保护: 带有适当阈值的锁定机制
  • Session management: Secure token generation (≥128 bits entropy)
    中文： 会话管理: 安全的令牌生成（≥128位熵）
  • Session lifecycle: Proper invalidation on logout/timeout
    中文：[ ] 会话生命周期: 登出/超时时的正确失效
  • Re-authentication: Required for sensitive operations
    中文： 重新认证: 对敏感操作的要求
  • Multi-factor authentication: Implementation for high-risk accounts (for more information, see Multifactor Authentication Cheat Sheet
    中文：[ ] 多因素认证: 高风险账户的实施（更多信息，请参阅 多因素认证速查表
  • Password reset: Secure, time-limited reset mechanisms (for more information, see Forgot Password Cheat Sheet
    中文：[ ] 密码重置: 安全、时间限制的重置机制（更多信息，请参阅忘记密码速查表
  • Session security: HttpOnly, Secure, SameSite cookie attributes
    中文： 会话安全: HttpOnly, Secure, SameSite cookie属性
  • Concurrent sessions: Appropriate limits and monitoring
    中文：[ ] 并发会话: 适当的限制和监控

Authorization / 授权

  • Server-side enforcement: All access controls enforced server-side
    中文：[ ] 服务器端强制执行: 所有访问控制均在服务器端执行
  • Fail-safe defaults: Default deny access policy
    中文：[ ] 安全默认设置: 默认拒绝访问策略
  • IDOR prevention: Proper authorization for resource access (see Insecure Direct Object Reference Prevention Cheat Sheet
    中文：[ ] IDOR预防: 资源访问的正确授权（请参阅不安全直接对象引用预防速查表
  • Function-level controls: Administrative functions properly protected
    中文：[ ] 函数级控制: 管理功能得到适当保护
  • Role validation: Role assignments cannot be manipulated
    中文：[ ] 角色验证: 角色分配不可被操纵
  • Privilege escalation: Horizontal and vertical escalation prevented
    中文：[ ] 权限提升: 水平和垂直提升被阻止
  • Centralized decisions: Access control logic centralized
    中文：[ ] 集中决策: 访问控制逻辑集中化
  • Post-authentication checks: Authorization verified after authentication
    中文：[ ] 认证后检查: 认证后验证授权

Cryptography / 密码学

  • Strong algorithms: Modern algorithms (AES-256, RSA-2048+, ECDSA P-256+)
    中文：[ ] 强算法: 现代算法（AES-256, RSA-2048+, ECDSA P-256+）
  • Key management: Proper key generation, storage, and rotation (for more information, see Key Management Cheat Sheet
    中文：[ ] 密钥管理: 正确的密钥生成、存储和轮换（更多信息，请参阅密钥管理速查表
  • Certificate validation: Proper validation including hostname verification
    中文：[ ] 证书验证: 正确的验证，包括主机名验证
  • Random generation: Cryptographically secure random number generation
    中文：[ ] 随机生成: 密码学安全的随机数生成
  • Data protection: Encryption at rest and in transit
    中文：[ ] 数据保护: 静态和传输中的加密
  • IV/Nonce handling: Follow the selected mode's requirements for initialization vectors (IVs) and nonces. For example, cipher block chaining (CBC) requires unpredictable IVs, while Galois/Counter Mode (GCM) requires IV uniqueness under each key and permits deterministic generation
    中文：[ ] IV/nonce处理: 遵循所选模式对初始化向量（IVs）和nonce的要求。例如，密码块链接（CBC）需要不可预测的IV，而伽罗瓦/计数模式（GCM）要求每个密钥下的IV唯一并允许确定性生成
  • Library maintenance: Up-to-date cryptographic libraries
    中文：[ ] 库维护: 保持密码学库的最新状态
  • Side-channel protection: Consideration of timing and other side-channel attacks
    中文：[ ] 旁路攻击保护: 考虑时间和其他旁路攻击

Business Logic / 业务逻辑

  • Workflow integrity: Proper state validation in multi-step processes
    中文：[ ] 工作流完整性：多步骤过程中的正确状态验证
  • Race condition prevention: Synchronization in concurrent operations
    中文：[ ] 防止竞态条件：并发操作中的同步
  • Transaction atomicity: Proper rollback and consistency mechanisms
    中文：[ ] 事务原子性：正确的回滚和一致性机制
  • Resource limits: Rate limiting and resource quotas implemented (see Denial of Service Cheat Sheet
    中文：[ ] 资源限制: 实施速率限制和资源配额（请参阅拒绝服务速查表
  • Business rule enforcement: Cannot bypass rules through direct API access
    中文：[ ] 业务规则执行：不能通过直接API访问绕过规则

Configuration & Deployment / 配置与部署

  • Secure defaults: Security-focused default configurations
    中文：[ ] 安全默认设置：以安全为重点的默认配置
  • Environment separation: Proper isolation between environments
    中文：[ ] 环境隔离: 环境间适当隔离
  • Secrets management: No hardcoded secrets, proper secret storage and rotation (for more information, see Secrets Management Cheat Sheet
    中文：[ ] 秘密管理: 不使用硬编码的秘密，正确的秘密存储和轮换（更多信息，请参阅秘密管理速查表
  • Error handling: Graceful error handling without information disclosure (for more information, see Error Handling Cheat Sheet
    中文：[ ] 错误处理: 无信息泄露的优雅错误处理（更多信息，请参阅错误处理速查表
  • Logging security: Sensitive data not logged, proper log protection (for more information, see Logging Cheat Sheet
    中文：[ ] 日志安全: 不记录敏感数据，正确的日志保护（更多信息，请参阅日志速查表
  • Security headers: Appropriate HTTP security headers configured (for more information, see HTTP Headers Cheat Sheet
  • TLS configuration: Strong cipher suites and protocol versions (for more information, see Transport Layer Security Cheat Sheet
  • Dependency management: Up-to-date libraries without known vulnerabilities (for more information, see Vulnerable Dependency Management Cheat Sheet

Security Monitoring / 安全监控

  • Security events: Authentication failures, authorization violations logged
    中文：[ ] 安全事件: 记录的认证失败和授权违规
  • Anomaly detection: Unusual patterns and behaviors monitored
    中文：[ ] 异常检测: 监控不寻常的模式和行为
  • Audit trails: Complete audit logs for sensitive operations
    中文：[ ] 审计跟踪: 敏感操作的完整审计日志
  • Real-time alerts: Critical security events trigger immediate notifications
    中文：[ ] 实时警报: 关键安全事件触发即时通知
  • Log integrity: Logs protected from tampering and unauthorized access
    中文：[ ] 日志完整性: 防止日志被篡改和未经授权的访问
  • Incident response: Clear procedures for security incident handling
    中文：[ ] 事件响应: 安全事件处理的明确程序

Tools and Techniques / 工具和技术

Code Editors / 代码编辑器

Use editors with security extensions:

使用具有安全扩展的编辑器：

  • Visual Studio Code with ESLint, SonarLint
    中文：Visual Studio Code 配合 ESLint, SonarLint
  • IntelliJ IDEA with SpotBugs, SonarLint
    中文：IntelliJ IDEA 配合 SpotBugs, SonarLint
  • Eclipse with security plugins
    中文：Eclipse 配置安全插件
  • Vim/Neovim with security linters

Command-Line Pattern Detection / 命令行模式检测

# Find hardcoded secrets
grep -ri "password\s*=\|api_key\s*=\|secret\s*=" source/

# Find unsafe functions
grep -r "eval(\|exec(\|innerHTML\|document\.write" source/

# Find potential injections
grep -r "SELECT.*+\|executeQuery.*+" source/

Manual Review Focus Areas / 手动审查重点区域

Human Expertise Advantages:

人类专家优势：

  • Business Logic Flaws: Complex workflows and state management issues that require domain understanding
    中文：业务逻辑缺陷： 复杂的工作流程和状态管理问题，需要领域理解
  • Context-Specific Vulnerabilities: Security issues that depend on application-specific business rules
  • Authorization Logic: Complex permission models and access control implementations
  • Race Conditions: Timing-based vulnerabilities in concurrent operations
  • Cryptographic Misuse: Proper implementation of cryptographic primitives and protocols
  • Architecture Security: High-level design flaws and security anti-patterns

Manual Analysis Techniques:

  • Code Path Tracing: Following execution paths through complex business logic
  • State Analysis: Understanding application state transitions and validation
  • Trust Boundary Mapping: Identifying and analyzing security control points
    中文：信任边界映射：识别和分析安全控制点
  • Threat Modeling Integration: Applying threat models to specific code implementations
    中文：威胁建模集成：将威胁模型应用于特定的代码实现
  • Attack Scenario Simulation: Mentally simulating attack paths through the code
    中文：攻击场景模拟：通过代码模拟攻击路径

Automated Tool Integration / 自动化工具集成

Supporting Manual Reviews:

支持人工审查：

  • SAST Tool Triage: Use automated findings to prioritize manual review areas
    中文：静态应用安全测试工具分类：使用自动化发现结果来优先处理人工审查区域
  • Dependency Scanning: Identify vulnerable libraries requiring manual assessment
    中文：依赖项扫描：识别需要手动评估的易受攻击库
  • Code Quality Metrics: Focus manual effort on complex or frequently changed code
    中文：代码质量指标：将人工精力集中在复杂或频繁更改的代码上
  • Pattern Detection: Use tools to highlight potential security anti-patterns for human analysis
    中文：模式检测: 使用工具突出显示潜在的安全反模式以供人工分析

Tool Integration Strategy:

工具集成策略:

  • Pre-Review Scanning: Run automated tools before manual review to identify obvious issues
    中文：预审扫描: 在人工审查之前运行自动化工具以识别明显问题
  • Complementary Analysis: Use tool findings to guide deeper manual investigation
    中文：补充分析: 使用工具发现结果来指导更深入的人工调查
  • False Positive Filtering: Apply human judgment to validate automated findings
    中文：误报过滤: 应用人工判断以验证自动化发现
  • Coverage Gaps: Focus manual review on areas automated tools cannot effectively analyze
    中文：覆盖差距: 将人工审查集中在自动化工具无法有效分析的区域

Security Metrics:

安全指标:

  • Manual Review Coverage: Percentage of critical code paths reviewed by humans
    中文：人工审查覆盖率: 人工审查的关键代码路径百分比
  • Finding Quality: Ratio of valid security issues to total findings
  • Review Efficiency: Time spent on manual review vs. security value delivered
  • Trend Analysis: Security posture improvement over time

Documentation Templates

Finding Report Template:

Title: [Vulnerability Type] in [Component]
Severity: [Critical/High/Medium/Low]
CWE: [CWE Number and Name]
Location: [File:Line or Function]
Description: [Detailed explanation of the vulnerability]
Impact: [Security implications and potential attack scenarios]
Reproduction: [Steps to reproduce or proof of concept]
Recommendation: [Specific fix guidance with code examples]
References: [CWE links, OWASP references, vendor documentation]
Status: [Open/In Progress/Fixed/Accepted Risk]
Assignee: [Developer responsible for fix]
Due Date: [Target fix date]

Review Summary Template:

Review Summary
==============
Application: [Application Name]
Version: [Version/Commit Hash]
Reviewer(s): [Names]
Review Date: [Date]
Scope: [Files/Components Reviewed]

Findings Summary:
- Critical: [Count]
- High: [Count] 
- Medium: [Count]
- Low: [Count]
- Informational: [Count]

Key Recommendations:
1. [Priority recommendation]
2. [Priority recommendation]
3. [Priority recommendation]

Overall Risk Assessment: [Low/Medium/High/Critical]

Integration with SDLC

Review Timing

Baseline Review Integration / 基线审查集成

  • Project Initiation: Comprehensive security assessment of existing codebase
    中文：项目启动: 对现有代码库进行全面的安全评估
  • Major Releases: Full security review before significant version releases
    中文：主要版本发布: 在重大版本发布前进行全面安全审查
  • Architecture Changes: Complete review when fundamental design changes occur
    中文：架构变更: 发生根本性设计变更时的全面审查
  • Compliance Cycles: Periodic comprehensive reviews for regulatory requirements
    中文：合规周期: 为满足监管要求进行的定期全面审查
  • Security Incidents: Thorough review following security breaches or major vulnerabilities
    中文：安全事件: 在安全漏洞或重大安全事件发生后进行彻底审查
  • Onboarding Legacy Systems: Initial security assessment when bringing existing applications under secure development practices
    中文：集成旧系统: 将现有应用程序纳入安全开发实践时的初始安全评估

Diff-Based Review Integration / 差异审查集成

  • Pull Requests: Security-focused review of code changes as part of standard PR process
    中文：拉取请求：作为标准PR流程的一部分，对代码变更进行安全重点审查
  • Pre-commit Hooks: Lightweight security checks on developer commits
    中文：提交前钩子：对开发者提交进行轻量级安全检查
  • Feature Completion: Security review of completed user stories or features
    中文：功能完成：对完成的故事或功能进行安全审查
  • Sprint Reviews: Regular assessment of security implications of sprint deliverables
    中文：冲刺评审：定期评估冲刺交付成果的安全影响
  • Hotfix Reviews: Rapid security assessment of emergency fixes
    中文：热修复评审：对紧急修复进行快速安全评估
  • Continuous Integration: Automated triggering of security reviews based on code changes
    中文：持续集成：基于代码变更自动触发安全审查

Hybrid Approach / 混合方法

  • Risk-Based Scheduling: Combine baseline reviews for high-risk components with diff-based reviews for routine changes
    中文：基于风险的调度：将高风险组件的基线审查与基于差异的常规变更审查相结合
  • Incremental Baseline Updates: Gradually expand baseline review coverage over multiple development cycles
  • Trigger-Based Reviews: Escalate from diff-based to baseline review when significant security concerns are identified

For CI/CD integration and automated security testing, for more information see CI CD Security Cheat Sheet.

Team Collaboration

Roles:

  • Security reviewers: Conduct analysis and provide guidance
  • Developers: Implement fixes and follow secure coding practices
  • Security champions: Bridge security and development teams

Best Practices:

最佳实践：

  • Use standardized checklists and templates
    中文：使用标准化的清单和模板
  • Maintain a knowledge base of common issues
    中文：维护常见问题知识库
  • Track metrics on review effectiveness
    中文：跟踪审查效果指标
  • Provide regular security training
    中文：提供定期的安全培训
  • Integrate with existing development workflows
    中文：与现有开发工作流程集成

Advanced Techniques / 高级技术

Race Condition Analysis / 竞态条件分析

Focus on Time-of-Check vs Time-of-Use (TOCTOU) vulnerabilities and ensure atomic operations.

关注检查时间与使用时间（TOCTOU）漏洞并确保原子操作

Business Logic Analysis / 业务逻辑分析

Analyze workflows for:

分析以下工作流程：

  • State transitions and validation
    中文：状态转换和验证
  • Opportunities to bypass steps or validation
    中文：绕过步骤或验证的机会
  • Proper validation at each workflow step
    中文：在每个工作流程步骤中进行适当的验证
  • Rollback mechanisms and cleanup on failures
    中文：失败时的回滚机制和清理
  • Behavior under concurrent access
    中文：并发访问下的行为
  • Boundary conditions and error scenarios
    中文：边界条件和错误场景

Security Architecture Review / 安全架构审查

Review architecture patterns for consistent security enforcement and proper API security controls; see the Secure Product Design Cheat Sheet.

审查架构模式以确保一致的安全执行和适当的API安全控制；参见安全产品设计速查表。

Memory Safety / 内存安全

Review buffer management, integer overflow protection, and resource limits.

审查缓冲区管理、整数溢出保护和资源限制。

References / 参考