1 min lesson
Secure code review like a pro
Describe what "The onsite hands you a few hundred lines of plausible-looking code and a clock" changes in practice.
Step 1 of 3
The onsite hands you a few hundred lines of plausible-looking code and a clock. The pros don't read top to bottom - they follow the data, from where untrusted input enters to where it does something dangerous.
Carry one method and narrate it. The reviewers are grading whether you have a repeatable approach that finds real bugs and a habit of pairing each finding with a fix an engineer can apply today.
Learn more
Full explanation
Follow the Data: the Review Method
Interactive diagram. Step through it with the Next and Previous controls below, or Tab to a region to read its detail.
Entry points → trust boundaries → sinks → controls, then triage and write. The boundary and control steps are the gates where bugs live.
This is the whole method in four words. It works on code you've never seen and in any language, because it follows the structure of how attacks actually work - untrusted data flowing to a dangerous operation without a control in between. Say the four words at the start of the round so the interviewer sees the method before you find anything.