Reviewing Larkfield's own code on the review staircase, eight steps climbed on every pass: scope, threats, inputs, auth, data, crypto, errors and verify. A static scan reports zero findings while a client-supplied discount percentage flows straight into the price with no server-side bound, found only by a human reviewer. A forty-file pull request is reviewed by risk, refund endpoint first, not in diff order; and a report export that concatenated a column name and filter value into SQL is fixed with an allow-listed column and a bound parameter, then verified with a regression test.

CY-MID-068Mid Level · Secure Code Review

Secure Code Review — The Review Staircase

A hands-on mid-level course that finds security bugs in code before they ship. Climb the review staircase - eight steps: Scope, Threats, Inputs, Auth, Data, Crypto, Errors, and Verify - reviewing real code for injection, broken access control, and secrets, and confirming each fix. Strictly defensive. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Scope a review and reason from the code's threat model.
Find input-handling, authentication, and access-control flaws in code.
Spot data-exposure, crypto-misuse, and error-handling bugs.
Confirm fixes and feed findings back to developers well.

Price:৳8,000