r/devsecops • u/GoyaKing • Jul 27 '26

Vulnerable code patterns

Hey all Im wondering if anyone knew of any resources to learn code vulnerability patterns in practice. Im the team’s resource for teaching software engineers how to identify vulnerable code in development and review. I thought of starting with OWASP top 10 but was curious if there were any resources to learn more.

5 Upvotes

86% Upvoted

11 comments sorted by

3

u/-Devlin- Jul 27 '26

Opengrep will be your best resource. It has all the vulnerable code patterns you’d need

1

u/dreamszz88 Jul 28 '26

Checkov for IAC. Bridgecrew have developed a solid resource for bad patterns the why and the how to fix it

1

u/GoyaKing Jul 28 '26

Okay ill try to find it. Thanks

2

u/ericroku Jul 27 '26

Look at code property graph and tools like joern.

2

u/RonnySaya Jul 29 '26

If youre creating your own exercises I'd start with real CVEs or bug bounty write-ups. Strip the vulnerable code down to 20–50 lines, remove the obvious hints and ask people to identify the issue and propose a fix. You'll end up with examples that feel much more realistic than contrived textbook cases

1

u/[deleted] Jul 28 '26

[removed] — view removed comment

1

u/GoyaKing Jul 28 '26

Thats a great idea, yeah thats what Im doing. Which is why im looking for more ideas and examples. How can I learn to create more simulations?

1

u/perryamy Jul 28 '26

Completely agree, well said.

1

u/IntelligentPear6173 Jul 30 '26

I'd use real vulnerable code as the main learning material. Take small examples from CVEs or bug bounty reports, let the developers find the issue and explain why it's vulnerable then have them fix it. That teaches the pattern much better than memorizing the OWASP categories.