Cybersecurity glossary
What is Code Review?
Learn what code review is, why peer review catches security defects early, how to structure secure reviews, and what automated checks should complement human judgment.
Definition
Code review is a quality and security practice where peers examine proposed changes before merge—assessing correctness, maintainability, and abuse potential so defects are fixed while context is fresh and blast radius is small.
Why code review matters
Automated tests prove selected behaviors. Attackers invent the rest. Code review adds a second human brain to ask how a change fails under malice: missing authorization checks, unsafe parsers, debug endpoints left on, or secrets in fixtures.
Done well, review is cheaper than incident response and faster than waiting for a quarterly pen test to rediscover yesterday’s merge.
What strong reviews examine
Trust boundaries
New inputs, serializers, file parsers, and RPC methods that accept attacker-influenced data.
Authorization paths
Object-level checks, role changes, and admin-only features that might be reachable more widely.
Secret and config hygiene
Hard-coded credentials, overly broad IAM, and insecure defaults in infrastructure-as-code.
Abuse and failure modes
Rate limits, error leakage, race conditions, and what happens when dependencies are unavailable.
A practical review workflow
Author prepares context
Describe intent, risk areas, test evidence, and any deliberate security trade-offs.
Automation runs first
CI executes tests, SAST/SCA, secret scanning, and style checks before humans invest time.
Peer reads for intent
Reviewers validate that the change matches the stated goal and architectural norms.
Security pass
Sensitive paths get checklist scrutiny; high-risk modules may require designated reviewers.
Resolve and merge
Findings are fixed or explicitly accepted with owners; protected branches enforce the gate.
Review focus by change type
| Change type | Look especially for | Useful extra gate |
|---|---|---|
| Auth / session / IAM | Broken object checks, privilege escalation | Security CODEOWNERS approval |
| Parsers and uploads | Injection, path traversal, resource exhaustion | Fuzz harness or corpus tests |
| Crypto / secrets | Home-grown crypto, key handling mistakes | Cryptography specialist review |
| CI/CD and IaC | Privilege creep, public exposure | Platform team approval |
Secure code review checklist
- Keep pull requests small enough to review thoughtfully in one sitting.
- Require reviews on protected branches; ban force-pushes to defaults.
- Assign CODEOWNERS for auth, payments, crypto, and pipeline directories.
- Ask how untrusted input reaches new sinks—never assume framework magic.
- Verify tests cover failure and abuse cases, not only happy paths.
- Reject secrets, production data, and unexplained binary blobs in the diff.
- Document accepted risks with an owner and expiry—not silent TODOs.
- Train reviewers with real past vulnerabilities from your own stack.
The practical takeaway
Code review is a human control that catches design and logic flaws automation still misses. It works when diffs are readable, expectations are explicit, and high-risk code has qualified reviewers.
Pair peer judgment with CI security gates. Neither alone is enough; together they form one of the highest-leverage AppSec habits a team can keep.
Related security terms
Static Application Security Testing (SAST)
Automated analysis that complements human review of security-sensitive code.
Threat Modeling
Design-level analysis that informs what reviewers should scrutinize.
Secure Software Development Lifecycle (SSDLC)
Where mandatory review gates fit in the broader lifecycle.
Shift Left Security
Catching issues in review instead of after production incidents.
Application Security (AppSec)
The broader program that sets secure review expectations.
Frequently asked questions
What is code review in simple terms?
Someone else reads your change before it lands on the main branch, looking for bugs, risky designs, and unclear intent—not just style nits.
Does code review replace security scanners?
No. Scanners scale for known patterns; humans catch business-logic abuse, insecure design choices, and context scanners miss. Use both.
What makes a security-focused code review effective?
Clear ownership, small diffs, threat-aware checklists for auth and data handling, and time to question assumptions—not rubber-stamp approvals.
Should every change require two reviewers?
High-risk areas (auth, crypto, payments, pipeline config) often need stronger review rules. Low-risk docs may use lighter gates. Risk-base the policy.
Can AI assist with code review?
AI can flag common issues and summarize diffs, but it can also hallucinate. Keep humans accountable for merge decisions on sensitive code.
How large should a reviewable change be?
Prefer small, focused pull requests. Huge diffs hide vulnerabilities and encourage skim approvals.
What is a secure code review versus a regular review?
Secure review explicitly hunts for attacker-controlled inputs, trust-boundary crossings, secrets, and privilege changes—not only functional correctness.
References
Explore authoritative guidance and frameworks related to code review.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.