Scribd
Upload
1 views2 pages

Security Code Review Checklist

The document outlines a security code review checklist for the EPES Cloud Adoption project, detailing the expected results and actual outcomes for various security checks. Each check addresses critical security aspects such as linting code, implementing CSRF tokens, and managing environment variables. The review was conducted by a team and accepted by the project lead, confirming that all necessary security measures were met with no remedial actions required.

Uploaded by

Paul Jones
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
1 views2 pages

Security Code Review Checklist

The document outlines a security code review checklist for the EPES Cloud Adoption project, detailing the expected results and actual outcomes for various security checks. Each check addresses critical security aspects such as linting code, implementing CSRF tokens, and managing environment variables. The review was conducted by a team and accepted by the project lead, confirming that all necessary security measures were met with no remedial actions required.

Uploaded by

Paul Jones
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Security Code Review - Checklist

A Security code review checklist is a manual process of checks that a project team should perform on any
coding project that is being prepared to go from a testing or development environment to a production or live
environment. These can take many forms. The example given below is a checklist that would be required to be
filled in manually and signed off by a project lead. (Example result and remedial action provided for
illustration.)

Project Name: EPES Cloud Adoption


Date of Review: 22/08/2022

Reviewers: P. Jones, C. Erwin, K. Ainsley

Checklist

# Check Expected Result Actual Result Remedial Action

Code has been linted and all


dependencies/packages checked via
All code linted as
relevant software to ensure no Linted code and
1 per PEP8 None needed.
vulnerabilities or issues are found such as dependencies are safe.
standards
hardcoded SQL statements or insecure
packages.

Any web forms have the CSRF Token All web forms
All web forms have
2 added in to avoid attack vectors and have CSRF token None needed.
CRSF Token added
stealing data. added.

In the settings files has the Debug Mode Debug Mode set to Debug Mode set
3 None needed.
been disabled. FALSE to FALSE

All hard coded


Hard coded variables (e.g., Secret Keys)
variables stored All Secrets stored Secrets to be
have been removed from settings files
4 securely and via Environment stored via AWS
and contained securely via vaults or
separately to main Variables Secrets Manager
environment variables.
program code.

Environment variables
Are all environment variables being used set correctly. All environment
5 correctly, and not being pushed to the Information is not variables set None needed.
repository. being pushed to the correctly.
repository.

Adapt to
Any raw SQL queries are not being used All raw SQL has been
SQL Queries hard Dynamic SQL
6 and have been replaced with models et. removed from the
coded Queries (Out of
Al. code.
Scope for PoC)

All initially required


All hosts
allowed/disallowed
configuration set
Have allowed/disallowed hosts lists been hosts have been
7 via IAM and None needed.
configured correctly? configured correctly
Microservice
using correct
configuration.
environment variables.

Have all user permissions been applied All users only provided Least Privilege
8 None needed.
using principle of minimum usage? the access/rights that applied to all
they require. users/services

Code Review Accepted by: P. Jones Signed: P. Jones, Date: 23/08/2022.

You might also like