Hands-on secure code review
Code review is a skill.
Practice it.
Build the instinct that catches vulnerabilities in review.
Loading the weekly featured challenge…
Build the instinct that catches vulnerabilities in review.
Build the instinct that catches vulnerabilities before they ship. Review realistic production code, choose the vulnerable line, and learn from the explanation.
LaunchLane is a Spring Boot platform for deploying production projects and managing teammates through Spring for GraphQL. A legacy link-sharing transport lets developers open GraphQL documents from the internal explorer. Review the GET and POST GraphQL paths and how they handle browser-authenticated state changes. A successful exploit lets an attacker add their email as an organization owner, exposing deployments, environment secrets, and customer infrastructure.
“We dropped Code Review Lab into our security training rotation. Two weeks later our engineers were catching things in PR review we'd historically missed.”
This week's featured challenge takes about 15 minutes.