The cheapest place to kill a vulnerability is in review, before it ships. Secure code review is reading code specifically for the patterns that become breaches.
What to look for
- Injection - any place user input reaches a query, command, or template without parameterization/escaping (SQLi, command injection, SSTI).
- Broken authn/authz - missing access checks (IDOR/BOLA), weak session/JWT handling, trusting client-side controls.
- SSRF - server fetching user-supplied URLs without allow-listing.
- Secrets in code - hardcoded keys, passwords, tokens.
- Unsafe deserialization and dangerous
eval-like sinks. - Weak crypto - homegrown crypto, ECB mode, missing signature verification.
- Missing input validation + output encoding (XSS).
Trace input to sink
The core technique: follow untrusted input (request params, headers, uploaded files, third-party data) to where it's used (a query, a shell, HTML, a file path). If it isn't properly handled along the way, that's your bug.
Make it scale
Manual review catches logic flaws; automate the rest. Run SAST (Semgrep, CodeQL, Bandit) and dependency scanning (OSV-Scanner, Dependency-Check) in CI, and reserve human review for auth, crypto and business logic - where tools are weakest and the impact is highest.