Business logic security: review checkout and money-moving flows
Review checkout, pricing, refunds, subscriptions, approvals, and concurrent actions by defining server-side business invariants and verifying allowed state changes.
Read the guideApplication security · 8 guides
Build stronger application boundaries
Developer-focused explanations of common web application risks, the controls that address them, and the evidence needed to verify a fix.
CSRF protection checklist for authenticated web workflows
Review cross-site request forgery defenses across cookie authentication, state-changing actions, tokens, origin checks, SameSite settings, and workflow tests.
Read the guideHTTP security headers: a practical application review guide
Review CSP, HSTS, framing, content types, referrer policy, and response consistency with a rollout plan that protects real application workflows.
Read the guideSecure file upload checklist: validation, storage, and delivery
Review file uploads across business requirements, server-side validation, processing isolation, storage permissions, downloads, and ownership checks.
Read the guideSource maps and client secrets: review release exposure
Review browser bundles, source maps, environment variables, public artifacts, and secret rotation to understand what your software release exposes.
Read the guideSQL injection prevention: what a code review should verify
Review SQL injection defenses across parameterized values, dynamic query structure, ORM escape hatches, database permissions, and regression testing.
Read the guideSSRF prevention for cloud-connected applications
Review server-side URL fetching, destination policies, redirects, DNS behavior, workload permissions, and network egress to reduce SSRF exposure safely.
Read the guideXSS prevention: review data from input to browser output
Review cross-site scripting defenses through output context, template escaping, HTML sanitization, DOM sinks, and CSP, then verify fixes in the real workflow.
Read the guide