BERRY9 IT Services, home +91 86868 92922

Secure Code Review Checklist for Web Apps

Manual secure code review is a different exercise from pen-testing. The questions are different, the evidence is different, the time it takes per finding is different. Here is a walkable checklist, organized by category.

Request a scoping call Call +91 86868 92922

Source code · By Thimmagurudu Bathini · Published · 7 min read · Last reviewed

Authentication and session

  • Password storage uses a modern KDF (Argon2id, bcrypt with cost ≥ 12, scrypt). No MD5, SHA-1, custom hashing.
  • Session identifiers are cryptographically random (≥ 128 bits of entropy).
  • Session rotation on login, privilege change, password change.
  • JWT verification pins the algorithm; no header-driven algorithm selection.
  • Password reset tokens are single-use, short-lived (≤ 30 minutes), and tied to the requesting context.

Authorization

  • Every endpoint that returns or mutates an object validates ownership against the authenticated user.
  • Centralized authorization layer; not scattered ad-hoc checks.
  • Role checks at function entry; no client-side role gating as the only check.
  • Tenant isolation enforced at the repository layer (queries take tenant ID as a mandatory parameter).

Input validation and output encoding

  • All database queries parameterized; ORM raw fragments audited.
  • HTML output encoded by default (framework defaults engaged, not opted out).
  • JSON parsing limited in depth and size; no deserialization of untrusted formats (Java native, PHP unserialize, pickle).
  • File upload — extension allowlist, content type verification, server-side rename, storage outside webroot.

Cryptography and secrets

  • No hardcoded secrets in source. Secrets in a vault, injected at runtime.
  • Crypto via libraries, not hand-rolled. No ECB, no static IVs, no MD5-for-auth.

Configuration and dependencies

  • Production builds disable debug. No verbose stack traces in responses.
  • Dependencies pinned, scanned weekly. Lockfile committed.
  • Logging excludes PII, credentials, full tokens.

See source code review.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp