What is Code review?

What is code review?

Code review is the practice of having someone other than the author read a code change before it merges. Teams do it to catch defects, improve quality, and spread knowledge across the group. Most reviews now happen inside a pull request (PR), where a reviewer comments on the exact lines an author changed and approves the work once it meets the team standards.

Secure code review is the same idea with a sharper focus. Instead of only asking whether the code works, the reviewer also evaluates how it could be abused. That security lens looks for weak input handling, exposed credentials, broken access checks, and risky dependencies that a functional review often skips.

In practice, both goals live in the same pull request. A reviewer confirms the feature behaves as intended, then checks whether an attacker could turn that same code against you. When teams treat these as one unified habit rather than two separate steps, security stops being a bottleneck and becomes an everyday engineering baseline.

Secure Coding Best Practices [Cheat Sheet]

Get a quick-reference guide to secure coding best practices across languages and frameworks.

Your work email here

Download

Why code review matters for security

Finding a flaw during review is far cheaper than finding it after release. A bug caught in a pull request costs a comment and a quick edit. The same bug caught in production can mean an emergency response call, a rushed patch, and a public disclosure.

The stakes are significant. The global average cost of a data breach reached $4.88 million across all breach categories, and vulnerability exploitation continues to rise as a leading initial access vector. This economic reality is the driving force behind shift left initiatives, which move verification earlier in the software development lifecycle rather than waiting for downstream testing.

Consider a common scenario. A developer hardcodes an API key into a configuration file to test a local feature, then forgets to remove it before pushing. If a reviewer spots that key in the pull request, the fix takes minutes: revoke the credential, rotate it, and move it to a dedicated secret manager. If it ships to production instead, that key can sit in version control history indefinitely, exposed to anyone with repository access.

Consistent reviews also lower overall defect density over time. Every review transfers context across team members, ensuring subsequent pull requests start cleaner. That shared ownership prevents technical debt from accumulating and gives compliance auditors clear evidence that changes receive independent validation for standards like SOC 2 and ISO 27001.

Manual vs. automated code review

Manual and automated review solve different problems, so treating them as competitors misses the point. A human reader understands architectural intent and business rules. A scanner reads far more code, far faster, and applies the same checks across every commit. High-performing teams use both because each covers the other blind spots.

Static application security testing (SAST), for example, inspects source code without running it and flags risky patterns at scale. While SAST is effective at detecting known anti-patterns, it can also produce false positives that distract developers. A human reviewer is far better at judging whether a flagged execution path is truly reachable and whether a design choice creates a business logic flaw a scanner cannot infer.

The winning pattern is human-in-the-loop review. Let automated scanners handle repetitive syntax, dependency, and pattern checks on every pull request, then point human attention at the judgment calls machines get wrong. Reviewers spend their time evaluating risky logic instead of hunting for basic formatting errors.

wiz academy

Source Code Scanning: Automated Code Security Analysis

Source code scanning is automated analysis of your code, dependencies, and infrastructure definitions to find security issues before you deploy. This means a tool reads your code the way a careful reviewer would, but at high speed and at scale.

Read more

The code review process, step by step

A structured review follows a consistent flow whether it is a small routine pull request or a comprehensive subsystem audit.

1. Define the Objective: A diff-based review inspects only the lines modified in a pull request, while a baseline review audits an entire module from scratch. Clarifying the goal upfront establishes clear expectations for the reviewer.

2. Run the Review: Inspect the diff, evaluate automated scanner results, and leave clear, contextual comments tied directly to specific lines.

3. Report Findings: Clearly communicate what the issue is, why it introduces risk, and provide a concrete recommendation for resolution.

4. Remediate: The author updates the branch with necessary corrections, and the reviewer verifies the updated diff.

5. Sign Off and Follow Up: Formal approval permits the pull request to merge into mainline, ensuring all automated policy gates pass before deployment.

wiz academy

8 Essential Code Review Best Practices

Code review is a software development practice where code is systematically examined to ensure it meets specific goals, including quality and security standards.

Read more

Secure code review best practices

A few disciplined habits deliver the vast majority of security value during code reviews:

• Prioritize High-Risk Code: Focus human attention on authentication, authorization, and components that process sensitive customer data where flaws cause the most damage.

• Scan Early in CI/CD: Run SAST and software composition analysis (SCA) on every pull request so automated gates catch obvious issues first.

• Inspect Dependencies and Secrets: Flag vulnerable third-party packages and use automated secrets scanning to prevent credentials from entering version control.

• Review Infrastructure as Code: Treat infrastructure as code (IaC) files like Terraform and Kubernetes manifests with the same rigor as application logic, watching for open network routes and overly permissive cloud IAM roles.

• Verify Against Established Standards: Use the OWASP Top 10 and your team secure coding guidelines as a shared, objective baseline for feedback.

• Keep Diffs Manageable: Keep pull requests under 300 to 400 lines and review sessions under an hour, as defect detection drops off significantly past that point.

• Maintain a Blameless Culture: Frame comments around the code and its maintainability rather than the author, using shared checklists to apply consistent standards across the team.

Watch 5-min demo

See how a security-focused code review looks when automated scanning and live cloud context sit in one place.

Your work email here

Watch now

Code review checklist

Use this reference table during code reviews to evaluate changes across core security and operational categories:

Common code vulnerabilities to catch in review

A consistent group of software defects appears repeatedly in application diffs. Understanding how these code vulnerabilities appear makes them straightforward to detect and remediate before release.

Each unaddressed vulnerability expands your attack surface in production. The objective of code review is closing these vectors before code merges, avoiding expensive incident response workflows after deployment.

Integrating automation into the review pipeline

Automated tools should handle repetitive validation so human reviewers can focus on system architecture and business logic. Integrating pre-flight checks into CI/CD provides immediate feedback to developers on every pull request.

The following GitHub Actions configuration demonstrates an automated pull request gate that enforces linting, secret detection, and security policy checks:

name: "Pull Request Pre-Flight Gates"

on:
  pull_request:
    branches: [ "main" ]

jobs:
  security-and-lint:
    name: "Automated Linter and Security Gates"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Setup Python Environment
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Run Fast Linting
        run: |
          pip install ruff
          ruff check .

      - name: Scan for Exposed Secrets
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Execute Security Policy Checks
        run: |
          echo "Scanning repository against corporate security policies..."
          # Example CLI integration: wizcli scan --policy "CI-Gate-Policy"

Secure code from pull request to cloud runtime

Engineering teams frequently struggle with alert fatigue caused by disconnected security scanners. Running isolated tools produces long lists of findings without indicating whether a flagged vulnerability is actually deployed or reachable in production. Wiz Code bridges this gap by combining SAST, SCA, secrets detection, and IaC scanning into a single policy engine enforced from the IDE through the pull request.

What sets this approach apart is runtime context. Wiz Code connects repository findings directly to the Wiz Security Graph, linking source code to the live cloud resources it creates. When a vulnerability is flagged in a pull request, reviewers do not just see a static severity label; they see the true blast radius, including whether the affected resource is internet-facing, holds sensitive cloud permissions, or touches critical data stores.

Automated remediation streamlines the fix. The Green Agent analyzes root causes and automatically generates ready-to-merge pull requests with precise code fixes, routing them directly to the owning developer. Reviewers can inspect and merge fixes within their native workflow, resolving exploitable risks at the source before deployment.

Ready to learn more? Request a demo to see for yourself how Wiz secures your software pipeline from pull request to production across everything you build and run in the cloud.

See Wiz Code in action

Walk through secure code review with code-to-cloud context directly on your own environment.

Work Email*

First Name*

Last Name*

Country

Phone Number*

Company*

Keep me updated about Wiz product releases, industry news, and events (You can unsubscribe at any time)

Subscribe me to the Wiz blog digest emails

Submit

For information about how Wiz handles your personal data, please see our Privacy Policy.

Your work email here

Get a demo

FAQs