Reviewing inherited code — where to start with an OWASP Top 10 code review?

Manual regex/grep pattern searches go a long way: 1) Database calls with direct variable concatenation, 2) Hardcoded secret keys left in plaintext, 3) Catch blocks returning sensitive system info to the client. Finding these patterns only takes a few hours.

When we took over a portal of similar size, we caught 5 different privilege escalation bugs in two days just by doing a manual review. The automated scanners missed all of them because only a human reading the business logic knows who should see what data.

Start by auditing your third-party dependencies. Run your package manager's built-in audit commands and update anything with known vulnerabilities. Usually the biggest vulnerabilities agencies leave behind come from outdated libraries.

Two developers who didn't write the code are going to have a hard time securing someone else's architecture just by going down an OWASP checklist. If you're short on time, just focus on access control and database queries, don't get bogged down in complex crypto details.

check if you can access someone else's order by changing the id parameter in the url agencies always forget backend auth checks on those

edit: fixed a few typos.

When signing enterprise logistics clients, it's standard for them to request an independent security audit report. While this internal review will harden your system, it may not legally substitute for a third-party audit report.

Is your system multi-tenant? Meaning, do all logistics clients share the same database? If so, the single most critical focus of your review must be the tenant isolation mechanism that prevents one client from leaking into another's tables.

It might seem daunting for a small team, but turning the OWASP guide into a step-by-step checklist will do wonders for your team's engineering mindset. As you catch business logic flaws, your overall architecture will get significantly more robust.

The cheap-looking path usually ends up costing more later. Having backups accessible on the same network and with the same identity makes them part of the target.

Timely topic. If you don't write this down from the start, it leads to arguments later.

If you have questions, write them; I'll answer as best I can.

I partly agree, partly disagree. Most time waste accumulates in tasks waiting for approval.

Let me summarize what's been said so far. Mistakes made on the owasp top 10 code review side are usually reversible but expensive.

Just leaving this note, it might be useful.

There's a part I don't understand. If the notification path is long notifications don't arrive; missing notifications mean delayed incident detection.

Just because everyone does it doesn't mean it's right. Good luck with that.

There's a trap here, let me mention it. People defend habits, not processes. Resistance comes from there.

Proven by experience.

Let me speak from the other side; I'm on the supplier side. Don't rely on a single measure; go layer by layer.

Trying to do this alone is the most expensive way. If I were you, I'd go this route.

saved.

Generally correct, but one part is missing. When making a decision, first look at what data you have on hand.

If you post the result here it will help others too.

Exactly like that. The biggest time-waster for us was not knowing who had the final say.

Trying to do this alone is the most expensive way.