4 guides tagged Code review, grouped by topic, with the SDLC phase and role each is written for.
Turn a pull request into a small set of security claims that can be checked against the surrounding system and tests.
Development, Testing · Developers, AppSec engineers
Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.
Development, Testing, Release, Security program · Developers, AppSec engineers, Platform engineers and SREs
Put a trained engineer with protected hours in every in-scope team, write the role into a one-page charter, route sensitive changes and findings through champions and AppSec, and judge the program by coverage and outcomes instead of attendance.
Testing, Security program · AppSec engineers, Security leaders
How an over-scoped GitHub token, extracted from an AWS CodeBuild pull request build, let a threat actor commit code to the Amazon Q Developer extension for VS Code that shipped in version 1.84.0 in July 2025, why the injected code aimed at the Q Developer CLI failed, and the CI and AI-agent controls the incident argues for.
Design, Development, Testing, Release, Maintenance · Developers, Platform engineers and SREs
All tags, lifecycle stages and roles
Type to search. Search runs in your browser.
Searching…
Searches run in your browser, but the host can infer them from the index files they load. The address shows your search so you can bookmark or share it.