B6: Detection, DevSecOps & Secure Code Review
Secure Code Review: PHP, Java, .NET & Python
Source-first vulnerability hunting across common enterprise stacks.
Open the interactive lesson & lab →
| Language | High-risk patterns | Review focus |
|---|---|---|
| PHP | Dynamic includes, loose comparisons, unserialize, SQL string building. | Routing, auth checks, file operations, templating, legacy helpers. |
| Java | Deserialization, SpEL/OGNL, SSRF, XML parsers, auth annotations. | Framework config, controllers, filters, dependency versions. |
| .NET | ViewState/config issues, deserialization, SSRF, path traversal, auth policy gaps. | Controllers, middleware, claims, model binding, secrets. |
| Python | pickle/yaml load, template injection, command execution, SSRF, debug mode. | Flask/Django routes, serializers, ORM usage, Celery/tasks. |
- Map entry points: routes, handlers, message queues, file uploads, scheduled jobs, and webhooks.
- Mark trust boundaries: user input, tenant boundary, admin boundary, internal service boundary.
- Trace to sinks: database, OS command, file path, template engine, deserializer, network client, auth decision.
- Check guards: validation, authorization, encoding, parameterization, allowlists, and safe APIs.
- Build minimal proof in a local or test environment, then write remediation tied to the framework.