Hands-on secure code review
Code review is a skill.
Practice it.
Build the instinct that catches vulnerabilities in review.
Loading the weekly featured challenge…
Build the instinct that catches vulnerabilities in review.
Build the instinct that catches vulnerabilities before they ship. Review realistic production code, choose the vulnerable line, and learn from the explanation.
TeamSync is a team-collaboration SaaS (think shared boards, tasks, and chat for distributed teams). Like every app, it ships a "forgot password" flow: a user submits their email and TeamSync sends them a link to choose a new password. The backend is Django. During a security review of the account-recovery code, take a close look at how the reset link is assembled before it goes out in the email.
“We dropped Code Review Lab into our security training rotation. Two weeks later our engineers were catching things in PR review we'd historically missed.”
This week's featured challenge takes about 15 minutes.