Many serious vulnerabilities are easiest to find in the code itself. This secure code review training teaches you how to review source code for security flaws, using a mix of manual techniques and static analysis tools, and how to turn what you find into clear fixes.
Who should attend
- Application security engineers and penetration testers
- Developers who perform or participate in code reviews
- Technical leads and architects
- DevSecOps engineers integrating code scanning into pipelines
- Developers who want to write secure code from the start can begin with our Secure Software Development Training.
Participants should be comfortable reading code in at least one programming language and have a basic understanding of how web applications work. No prior security experience is required, though familiarity with the OWASP Top 10 is helpful.
What you will learn
- Code review methodology: scoping, prioritization and risk-based review
- Reading code for security: data flow, trust boundaries and entry points
- Common vulnerability patterns in code: injection, access control, cryptography, secrets and more
- Reviewing authentication, session and authorization logic
- Reviewing business logic and sensitive workflows
- Using static analysis (SAST) tools and validating their results
- Reducing false positives and prioritizing findings
- Reviewing dependencies and third-party code usage
- Writing review findings with clear remediation guidance
- Building code review into the development process
Hands-on labs
Participants review realistic code samples, identify vulnerabilities and propose fixes. Exercises are based on vulnerability patterns our team finds in real engagements and research, such as the code-level analysis in our wp2shell research.
What you receive
- Course materials and code exercises
- A secure code review checklist
- A certificate of attendance
Frequently asked questions
Learn to find vulnerabilities in code
Contact us for dates, pricing and corporate options.
