Find vulnerabilities by reading code. This two-day advanced course covers security code review methodology, vulnerability patterns in Python, Node.js, Java and Go, tool-assisted review with Semgrep and CodeQL, AI-assisted review using Claude and GPT, and a structured triage process. Hands-on review exercises throughout.
Language-specific vulnerability patterns plus tool-assisted and AI-assisted review techniques. The capstone is a full code review exercise. (Times are approximate.)
A structured approach to security code review. Cover the preparation phase (architecture understanding, trust boundaries, data flows), the review itself (critical paths first, then breadth), and the reporting phase (clear findings, reproducible examples, severity ratings). This methodology applies regardless of language or framework.
Review the most common vulnerability patterns in Python applications: SQL injection via string formatting, command injection via os.system/subprocess with shell=True, pickle deserialization, SSTI in Jinja2, SSRF via requests, path traversal, and insecure use of eval/exec. Each pattern shown with vulnerable code and the secure alternative.
Review the most common vulnerability patterns in Node.js applications: prototype pollution, RegExp DoS (ReDoS), NoSQL injection in MongoDB, XSS through template engines, command injection via child_process, path traversal, insecure deserialization, and event loop blocking. Each pattern shown with vulnerable code and the secure alternative.
Review the most common vulnerability patterns in Java applications: SQL injection via string concatenation, XXE in DocumentBuilder, unsafe deserialization (ObjectInputStream, SnakeYAML, Jackson polymorphic), SSRF, Spring expression injection (SpEL), and path traversal. Each pattern shown with vulnerable code and the secure alternative.
Review the most common vulnerability patterns in Go applications: SQL injection via fmt.Sprintf, template injection in html/template vs text/template, command injection via os/exec, SSRF, path traversal (filepath.Join does not prevent ../ with absolute paths), race conditions, and improper error handling.
Write Semgrep rules that encode your organization's security patterns and anti-patterns. Cover pattern matching, metavariables, taint mode, and autofix. Build a rule library for your most common vulnerability patterns. Deploy rules as a pre-commit hook and CI check.
Write CodeQL queries that find vulnerabilities through data flow analysis. Cover source-sink analysis, taint tracking, and path queries. Build queries for your application's specific vulnerability patterns. Run queries locally and in GitHub Advanced Security.
Use Claude and GPT as code review assistants. Craft prompts that focus on security-relevant code paths. Understand what AI review catches well (common patterns, missing checks) and what it misses (business logic, race conditions, complex data flows). Build a prompt library for security-focused AI code review.
Build a security review checklist tailored to your organization's technology stack and risk profile. Map checklist items to ASVS requirements. Include language-specific, framework-specific, and infrastructure-specific items. Make the checklist actionable, not aspirational.
Security code review only works if it is sustainable. Cover how to integrate security review into existing code review workflows, how to prioritize what to review (not everything gets a deep review), how to communicate findings constructively, and how to track remediation.
Not every finding is critical. Cover CVSS scoring for internal findings, risk-based triage (exploitability, impact, data sensitivity, exposure), and how to communicate risk to non-security stakeholders. Practice triaging a set of findings from most to least critical.
Given a multi-file application in your chosen language, perform a complete security code review. Find at least 10 vulnerabilities, document each with a clear finding report (location, description, impact, recommendation), and rate by severity. Debriefed and scored.
Review the code review methodology, checklist, and Semgrep/CodeQL rule library you take away. Cover ongoing skill development and how to build security code review capability in your team.
Two days of hands-on security code review across Python, Node.js, Java and Go. Tool-assisted with Semgrep and CodeQL. AI-assisted with Claude and GPT. For senior developers and security engineers.
Corporate and sovereign cohorts, and bespoke on-site delivery, on request.