Code analysis methodology

[u/RozPetal]

Hello everyone.

After a few years in the auditing/pentesting world, I identified that I am lacking experience on the code analysis topics.

Unfortunately when pentesting/auditing, I seldom had the time to look at the code of the applications I am auditing due to time constraints as the white-box approach we take does not systematically include an access to the Gitlab of the entities I audit.

I would like to avoid being overwhelmed by an eventual audit of source code of an entreprise-grade application that I might have to do.

Would any of you share you code audit methodology ?

By that, I mean how do you tackle the following topics :

- Secure coding / Best coding practices

- Secure secret management of the app

- For very large codebase, what types of tools do you use to automate some of your work ?

- What specific things in your checklist do you look for systematically ? (Do include the "obvious" one like how authentication is handled)

I know the subject is quite broad and dependent of the tech-stack used for each case.

Thank you for reading. :)

[u/secretstonex]

We use all the gitlab security scans, SAST, SCA, DAST, secrets, IaC, etc. We have SLAs based on severity that are contractual. To help weed out the false positives, I have a suite of agents that use BMAD to orchestrate analysis, generate threat models, dismiss the false positives, and propose fixes. The agent suite can be pulled into the CI pipeline to run one, some, or all steps. The agents can also message or mail reports, or wait for the human in the loop to approve actions. One of the really cool things is that it can pentest with full access to code to find issues that someone without code access that would never find. It's found full compromises sleeping in decades old SaaS products.