How to spot common bugs in code review
One page per bug class that reviewers miss: what it looks like in a diff, the questions to ask, how to word the comment, and practice PRs that plant it.
- How to spot IDOR (missing object-level authorization): 6 practice PRs.
- How to spot N+1 queries: 5 practice PRs.
- How to spot check-then-act races (TOCTOU): 5 practice PRs.
- How to spot missing network timeouts: 4 practice PRs.
- How to spot off-by-one errors: 15 practice PRs.
- How to spot injection (untrusted input into a sink): 7 practice PRs.