Hands-on secure code review
Code review is a skill.
Practice it.
Build the instinct that catches vulnerabilities in review.
Loading the weekly featured challenge…
Build the instinct that catches vulnerabilities in review.
Build the instinct that catches vulnerabilities before they ship. Review realistic production code, choose the vulnerable line, and learn from the explanation.
ShiftPay is a Spring Boot payroll portal where hourly workers sign in to view payslips and update their bank deposit details. To keep people signed in across visits, the team added a 'Keep me logged in' option that drops a long-lived remember-me cookie, and a filter reads that cookie to auto-authenticate returning users. Review how the remember-me token is generated and trusted before a forged cookie hands someone else's paychecks to an attacker.
“We dropped Code Review Lab into our security training rotation. Two weeks later our engineers were catching things in PR review we'd historically missed.”
This week's featured challenge takes about 15 minutes.