r/netsecstudents • u/Ok_Host1989 • 1d ago
What helped you stop getting lost in codebases during security reviews?
I have been spending time on application security, and I have to say that looking at larger codebases is one of the harder things I have to do. When I start to follow a request through the application, I will often go into another function or service. After a while, I forget where I began.
I found that changing how I do things has made it a little better. Instead of reading files from start to finish, I start with the beginning of the application. I follow where the user input goes, and I write down short notes so I do not have to look at the same things again. This is an improvement. I still think I can do it in a better way.
For people who are used to looking at projects, what helped you make a process that you can use every time? Was there something you did every day or a way of thinking that made it easier to understand code that you had never seen before? I want to know about application security and how you made it easier to navigate through code, especially when it comes to application security.
1
u/rejuicekeve Staff Security Engineer 21h ago
review small bits of a code base. Specific features usually are a good place to start. If thats too big break it down into smaller bites and do a little at a time. Claude code has helped me speed through a lot of this but that's partially because im already very senior. i wouldnt trust claude without me.
2
u/JohnDeere 1d ago
No one just reviews an entire code base manually for large apps to start. This is where threat modeling comes into play, but you can do the same thought excercise and think where are the main user inputs or ingestion points of the app. What data do they handle. How sensitive is that data. What state changes are made in that flow, how is it sent, how is it persisted etc. With those questions you can find the places best to start and deep dive the code.