What do you look for in a secure code review?

Direct answer

What a strong answer covers

How it works

A secure review follows the data. Every value that comes from outside, request parameters, headers, files, messages, third-party responses, is traced through the code to see where it is validated, how it influences authorisation decisions, whether it reaches a query, a command, a template, a deserialiser, a file path, or an outbound request, and what happens if it is malformed or hostile. Alongside the data trace, the reviewer checks authentication and session handling, that authorisation is enforced on every object not just the endpoint, that secrets and keys are handled correctly, that cryptography uses vetted libraries with sane parameters, that concurrent operations cannot race past a check, and that logs neither leak sensitive data nor omit security events. Dependency changes get their own look.

Example

Reviewing an endpoint that generates PDF reports, the reviewer traced the template name parameter and found it concatenated into a file path, allowing traversal to any file the service could read. A second finding was an image URL fetched server-side with no allowlist, an SSRF into the internal network. Both were fixed before merge with an allowlist of template IDs and a URL fetcher restricted to public addresses and a set of hosts.

Common mistakes

• Reviewing only the diff without following where the data goes.
• Checking for injection but not for missing authorisation on object IDs.
• Approving a dependency bump without looking at what changed.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.