Domain overview
This domain covers static review, dangerous sinks, insecure patterns and the signals that reveal how an application can fail before any exploit is fired at runtime.
Curated public references
- semgrep.dev · Docssemgrep.dev/docs/
- codeql.github.com · Docscodeql.github.com/docs/
- OWASP Code Review Guideowasp.org/www-project-code-review-guide/
- MITRE CWEcwe.mitre.org/top25/archive/2024/2024_cwe_top25.html
- OWASP WSTG · 03 Source Code Reviewowasp.org/www-project-web-security-testing-guide/latest/2-Testing_Techniques_Explained/03-Source_Code_Review
- GitHub · github / codeqlgithub.com/github/codeql
Brief index
Foundations & Automated Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
C Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
Java Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
C# Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
Php Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
Node.js Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
Python Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
Go Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
Ruby Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
iOS Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
Android Source Code Auditing
Static review of code paths, dangerous functions and weak validation patterns.
Artifacts, Git, Docker & Dependency Auditing
Static analysis concepts that expose security-relevant defects before runtime exploitation.