Hands-on secure code review
Code review is a skill.
Practice it.
Build the instinct that catches vulnerabilities in review.
Loading the weekly featured challenge…
Build the instinct that catches vulnerabilities in review.
Build the instinct that catches vulnerabilities before they ship. Review realistic production code, choose the vulnerable line, and learn from the explanation.
TillPilot is a Java Android point-of-sale app used on restaurant tablets. Support staff can import downloadable `.tilldriver` packages for receipt printers and card readers from email or the Android document picker. Review the import path for packages selected with `ACTION_OPEN_DOCUMENT` and compare it with the managed-driver install path used for vendor-distributed drivers.
“We dropped Code Review Lab into our security training rotation. Two weeks later our engineers were catching things in PR review we'd historically missed.”
This week's featured challenge takes about 15 minutes.