CodeSentinel resource

A security review that leaves fewer blind spots.

Use this concise checklist to structure a review before a release: map the threat model, verify application controls, and leave a clear trail from finding to fix.

Get the checklistSee what it covers

What is inside

A useful first pass, from scope to sign-off.

The downloadable version is intentionally practical. It is a starting point for a review, not a certification or a substitute for your threat model and security team.

Before the review

  • Confirm the change scope, threat model, and security-sensitive data flows.
  • Identify new endpoints, permissions, dependencies, secrets, and infrastructure changes.
  • Record the expected security properties and the evidence needed to verify them.

Application controls

  • Verify authentication, session expiry, account recovery, and privilege boundaries.
  • Check authorization at the server-side data boundary for every read and write.
  • Validate input, encode output, protect state-changing requests, and handle errors safely.
  • Confirm sensitive data is minimized, encrypted in transit and at rest, and absent from logs.

Delivery and follow-through

  • Review dependency changes, lockfile integrity, build provenance, and secret scanning results.
  • Exercise abuse cases and failure paths; capture reproducible evidence for each finding.
  • Assign owners and due dates for findings, then re-test fixes before release.

Free security resource

Download the checklist

Save the complete checklist for your next pull request or release review. Join the security review list for updates from CodeSentinel.

Download the security-review checklist

Markdown file · practical review prompts · no sign-in required