Secure code review checklist: 90+ checks for every pull request, mapped to OWASP

The provided text details a comprehensive framework for performing security reviews on code changes, particularly pull requests, emphasizing structured, context-aware checks aligned with established standards like OWASP and ASVS. The core of the guidance is a detailed checklist organized by security domains—including Input Validation, Authentication, Authorization, Cryptography, Secrets, Dependencies, Configuration, API security, File handling, Business logic, and AI-generated code. It stresses that effective review requires checking only the areas modified in a diff, providing specific justifications tied to OWASP/CWE references for each finding. The framework also highlights the risks of human error, especially in complex areas like authorization, and proposes leveraging automation (Endor Labs AI Security Review) for pattern-matching while reserving human review for intent, policy, and design.

A secure code review checklist applies security checks only to the specific areas a pull request changes, marking the rest as N/A. Checks are categorized by domain, with each item providing a reason for failure and references to OWASP Top 10:2025, ASVS 5.0, or CWE IDs. Authorization receives the most scrutiny, focusing on scoping record lookups, tenant ID handling, ownership checks across object-level and tenant-level boundaries, and state-changing operations. Input validation focuses on parameterized queries, output encoding, and server-side validation with allowlists. Session handling requires rotation, secure cookie flags, and JWT verification. Cryptography mandates the use of vetted algorithms and CSPRNGs, while Secrets checks cover hardcoded credentials and history management. Dependencies mandate checking package existence, version pinning, and vulnerability reachability. Infrastructure as Code must avoid public exposure and use least privilege principles.

The structure of this guidance reveals a recognition that security review moves beyond simple syntax checking to encompass complex logical and architectural flaws. The emphasis on Authorization—where object-level checks (IDOR) are disproportionately emphasized over input handling—suggests the recognized failure mode in modern applications is not just input vulnerability, but flawed access control derived from implicit assumptions about ownership and context. This leads to a pattern where automated tools excel at detecting mechanical failures (Injection, Broken Access Control via patterns), while human review must focus on the high-level policy decisions (intent, tenant design) that drive the most severe risks. The discussion surrounding AI-generated code introduces an additional layer of complexity: agents often reproduce flawed patterns found in training data, necessitating a check not just for the presence of controls but for the *survival* of prior security posture across iterations—a reflection on systemic maintenance failure rather than isolated coding errors. The framework implicitly argues that while automation can handle mechanics, true cognitive sovereignty in security requires human judgment to adjudicate complex, context-dependent policies like access rights and data privacy when no simple regex applies.