When to Use
- Reviewing a proposed patch for a security vulnerability
- Verifying a fix addresses the root cause, not just a symptom
- Checking for variant vulnerabilities the fix might miss
- Ensuring regression tests adequately cover the vulnerability
- Validating that a fix doesn't introduce new attack surface
When NOT to Use
- Initial vulnerability discovery (use audit or static analysis skills)
- General code review without security context
- Performance optimization reviews
Review Checklist
1. Root Cause Analysis
- Does the fix address the root cause or just block one exploit path?
- Could an attacker reach the same vulnerable code via a different path?
- Are there other instances of the same bug pattern in the codebase?
2. Fix Completeness
- Does the fix handle all input variations (encoding, normalization, edge cases)?
- Are error paths also patched?
- Does the fix work across all supported platforms/configurations?
3. Bypass Analysis
- Can the fix be circumvented with different input encoding?
- Does the fix rely on client-side validation that can be skipped?
- Are there TOCTOU (time-of-check-time-of-use) windows?
4. Regression Testing
- Do tests exercise the exact vulnerability trigger?
- Do tests cover bypass attempts?
- Are negative tests included (ensure safe inputs still work)?
5. Side Effects
- Does the fix change any public API behavior?
- Could the fix cause denial of service (overly strict validation)?
- Does the fix introduce new dependencies with their own attack surface?
Common Fix Anti-Patterns
| Anti-Pattern | Problem |
|---|---|
| Blocklist approach | Attacker finds unlisted variant |
| Input length check only | Doesn't prevent malicious short inputs |
| Error suppression | Hides the symptom, not the cause |
| Single-layer defense | One bypass defeats entire mitigation |
| Fix in wrong layer | Vulnerability remains reachable via other callers |
Workflow
- Read the vulnerability report / advisory
- Understand the root cause and attack vector
- Review the diff with security lens
- Search for variant instances (
grep, CodeQL, Semgrep) - Verify test coverage of the vulnerability
- Check for bypass opportunities
- Document findings with severity assessment