code-review
Safeguard articles tagged "code-review" — guides, analysis, and best practices for software supply chain and application security.
60 articles
A Required Approval Proves a Button Was Clicked, Not That Anyone Read the Code
Branch protection requires review before merge. Your audit evidence shows one on every pull request for a year. It does not show whether any of them involved a person reading the diff, and for a meaningful share, they did not.
Which Changes Should Trigger a Security Review
Asking developers to involve security when it seems relevant fails in both directions, because relevance requires exactly the expertise the person does not have. Give them observable properties instead.
The Migration Is the Riskiest Part of the Pull Request
It runs in production with the highest privileges in your system, usually unattended, and gets reviewed as an implementation detail at the bottom of the diff. It can drop a constraint that was the only thing enforcing a security property.
The Twenty-Minute Review to Run Before You Add a Dependency
Adding a dependency takes ten seconds and commits you to trusting a stranger's code on your build machines for as long as the project lives. Six checks, the signals that should stop you, and what this deliberately does not defend against.
Git Ancestry Lies About Whether Work Shipped
A commit hash derives from its parents, so a rewrite gives identical changes new identities. is-ancestor answers graph position, not whether the change is present, and squash merges put most teams in this state permanently.
AI Writes Code Faster Than You Can Review It. Which Scanner Do You Point at It?
AI-generated code arrives faster than review can absorb and fails in distinct patterns. SAST, DAST, and reachability each catch part of that — and each misses a specific, predictable slice.
The Benefits of Using SAST Tools During Code Review
The real benefit of using SAST tools during code review isn't finding more bugs than a human reviewer — it's finding the specific bugs humans consistently miss, before merge.
Comparing open-source tools for secure Java code review
SpotBugs checks 400+ bug patterns, Find Security Bugs adds 144 more, and CodeQL needs a full build — no single free Java scanner covers everything.
Secure code review: the checklist reviewers actually need
Broken access control affects nearly every tested app and XSS remains the #1 CWE overall — both catchable in review. Here is a language-agnostic PR checklist.
Trojan Source: how Unicode bidi control characters hide malicious code in plain sight
CVE-2021-42574 scored 8.3 CVSS for a bug that isn't a parser flaw at all — it's Unicode's bidirectional text algorithm, weaponized against code review.
Can AI-Generated Code Be Trusted? A Security Review
A 2025 USENIX study found LLMs hallucinate nonexistent packages in up to 21.7% of code samples — and attackers are already registering the names.
The Python code review security checklist: eval, pickle, and shell=True
Bandit ships named checks for eval, pickle, and shell=True — B307, B301, B602 — yet these three smells still slip past manual review into production Python.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.