Advanced
Code Review
#security
#SQL-injection
#credentials
Security Review Comments
2 exercises — how to flag security vulnerabilities in code reviews with the right severity, specifics, and remediation guidance.
0 / 19 completed
1 / 19
You spot hardcoded credentials in a PR:
Which security review comment is best?
const API_KEY = "sk-live-abc123xyz";Which security review comment is best?
Option B is the only response that adequately handles the severity. Key elements:
1. Blocking: prefix — this is not optional.
2. Git history warning — even if removed, the key is visible in history. This is the critical insight most developers miss. Rotating the key is required regardless.
3. Correct fix — environment variable or secrets manager.
4. Merge gate — explicitly states the condition for merge.
Using "nit:" for a hardcoded credential would be a serious mistake — it signals the issue is optional. Security findings must use "Blocking:" or equivalent. For credentials exposed to git history, rotation is non-negotiable even if the PR is never merged.
1. Blocking: prefix — this is not optional.
2. Git history warning — even if removed, the key is visible in history. This is the critical insight most developers miss. Rotating the key is required regardless.
3. Correct fix — environment variable or secrets manager.
4. Merge gate — explicitly states the condition for merge.
Using "nit:" for a hardcoded credential would be a serious mistake — it signals the issue is optional. Security findings must use "Blocking:" or equivalent. For credentials exposed to git history, rotation is non-negotiable even if the PR is never merged.
2 / 19
You're reviewing code that builds an SQL query using string concatenation with user input. Complete the security comment:
"Blocking: This query is vulnerable to SQL injection — the user input is concatenated directly into the query string without parameterisation. An attacker could pass _____ and drop the entire table. Please use parameterised queries or a prepared statement."
"Blocking: This query is vulnerable to SQL injection — the user input is concatenated directly into the query string without parameterisation. An attacker could pass _____ and drop the entire table. Please use parameterised queries or a prepared statement."
`'; DROP TABLE users; --` is the classic SQL injection payload — the single quote closes the string, the semicolon ends the statement,
Using a concrete attack payload in a security review comment is intentional: it makes the vulnerability tangible and shows you understand the actual risk. Abstract language like "malicious input" doesn't communicate the specific threat as effectively.
The fix — parameterised queries (also called prepared statements) — separates the query structure from the data, making injection impossible. Examples:
DROP TABLE users is the malicious command, and -- comments out the rest of the original query.Using a concrete attack payload in a security review comment is intentional: it makes the vulnerability tangible and shows you understand the actual risk. Abstract language like "malicious input" doesn't communicate the specific threat as effectively.
The fix — parameterised queries (also called prepared statements) — separates the query structure from the data, making injection impossible. Examples:
cursor.execute("SELECT * FROM users WHERE id = ?", [user_id]) in Python, or ORM query builders.3 / 19
PR Description:
"Implemented new user profile endpoint. Uses a simple POST request to update user details."
During code review, you notice the endpoint doesn't validate the input 'email' field against a standard email format. You also observe that it directly stores the raw string value into the database without any sanitization or escaping. Which of the following comments would be most appropriate to add to the PR description?
Option A: "Great job on implementing the user profile endpoint! This is a solid foundation for future enhancements."
Option B: "Please ensure input validation is implemented for the 'email' field to prevent potential injection attacks. Consider using regular expressions or a library to validate email format before storing it in the database."
Option C: "The endpoint successfully updates user profiles. No further action required at this time."
Option D: "This implementation is highly scalable and will handle a large number of concurrent users without performance issues."
The correct answer (Option B) addresses the immediate security risk. Simply stating that input validation should be implemented highlights the vulnerability - specifically regarding injection attacks due to the lack of sanitization on user-provided data before storing it in the database. Options A and C are overly positive and don't address the core issue, while Option D focuses on scalability which is irrelevant to this particular comment. A good code review comment should flag potential risks alongside a suggestion for remediation.
4 / 19
' OR '1='1 and drop the entire table. Please use parameterised queries or a prepared statement."The correct answer focuses on escaping user inputs before using them in an SQL query. While escaping is a good practice, it's not sufficient to mitigate SQL injection vulnerabilities when string concatenation is involved. Parameterized queries are the standard defense as they treat user input as data, not executable code, preventing attackers from injecting malicious SQL commands. Options A and D address different aspects of security but don't directly solve the core issue of the vulnerable query construction.
5 / 19
You're reviewing code that fetches data from an external API and displays it on a webpage. The code doesn't perform any sanitization or escaping of the response before rendering it to the browser. During your review, you identify a potential XSS (Cross-Site Scripting) vulnerability. Which of the following comments would be most appropriate to add to the PR description?
During a code review, you notice that the API response is directly inserted into the DOM without any precautions. An attacker could inject malicious JavaScript code into the API response, which would then execute in the user's browser when they view the webpage.
The correct answer (B) highlights the critical need for input sanitization and escaping before displaying data received from external sources. This directly addresses the XSS vulnerability by preventing malicious scripts from being injected into the DOM. Options A, C, and D are irrelevant to the immediate security concern identified during the code review – they focus on performance or basic integration aspects without tackling the core vulnerability.
6 / 19
PR Description:
"Implemented new user profile endpoint. Uses a simple POST request to update user details."
During code review, you notice the endpoint doesn't validate the input 'email' field against a standard email format. You also observe that it directly stores the raw string value into the database without any sanitization or escaping. Which of the following comments would be most appropriate to add to the PR description?
Option A: "Great job on implementing the user profile endpoint! This is a solid foundation for future enhancements."
Option B: "Please ensure input validation is implemented for the 'email' field to prevent potential injection attacks. Consider using regular expressions or a library to validate email format before storing it in the database."
Option C: "The endpoint successfully updates user profiles. No further action required at this time."
Option D: "This implementation is highly scalable and will handle a large number of concurrent users without performance issues."
The correct answer (Option B) addresses the immediate security risk. Simply stating that input validation should be implemented highlights the vulnerability - specifically regarding injection attacks due to the lack of sanitization on user-provided data before storing it in the database. Options A and C are overly positive and don't address the core issue, while Option D focuses on scalability which is irrelevant to this particular comment. A good code review comment should flag potential risks alongside a suggestion for remediation.
7 / 19
' OR '1='1 and drop the entire table. Please use parameterised queries or a prepared statement."The correct answer focuses on escaping user inputs before using them in an SQL query. While escaping is a good practice, it's not sufficient to mitigate SQL injection vulnerabilities when string concatenation is involved. Parameterized queries are the standard defense as they treat user input as data, not executable code, preventing attackers from injecting malicious SQL commands. Options A and D address different aspects of security but don't directly solve the core issue of the vulnerable query construction.
8 / 19
You're reviewing code that fetches data from an external API and displays it on a webpage. The code doesn't perform any sanitization or escaping of the response before rendering it to the browser. During your review, you identify a potential XSS (Cross-Site Scripting) vulnerability. Which of the following comments would be most appropriate to add to the PR description?
During a code review, you notice that the API response is directly inserted into the DOM without any precautions. An attacker could inject malicious JavaScript code into the API response, which would then execute in the user's browser when they view the webpage.
The correct answer (B) highlights the critical need for input sanitization and escaping before displaying data received from external sources. This directly addresses the XSS vulnerability by preventing malicious scripts from being injected into the DOM. Options A, C, and D are irrelevant to the immediate security concern identified during the code review – they focus on performance or basic integration aspects without tackling the core vulnerability.
9 / 19
PR Description:
"Implemented new user profile endpoint. Uses a simple POST request to update user details."
During code review, you notice the endpoint doesn't validate the input 'email' field against a standard email format. You also observe that it directly stores the raw string value into the database without any sanitization or escaping. Which of the following comments would be most appropriate to add to the PR description?
Option A: "Great job on implementing the user profile endpoint! This is a solid foundation for future enhancements."
Option B: "Please ensure input validation is implemented for the 'email' field to prevent potential injection attacks. Consider using regular expressions or a library to validate email format before storing it in the database."
Option C: "The endpoint successfully updates user profiles. No further action required at this time."
Option D: "This implementation is highly scalable and will handle a large number of concurrent users without performance issues."
The correct answer (Option B) addresses the immediate security risk. Simply stating that input validation should be implemented highlights the vulnerability - specifically regarding injection attacks due to the lack of sanitization on user-provided data before storing it in the database. Options A and C are overly positive and don't address the core issue, while Option D focuses on scalability which is irrelevant to this particular comment. A good code review comment should flag potential risks alongside a suggestion for remediation.
10 / 19
' OR '1='1 and drop the entire table. Please use parameterised queries or a prepared statement."The correct answer focuses on escaping user inputs before using them in an SQL query. While escaping is a good practice, it's not sufficient to mitigate SQL injection vulnerabilities when string concatenation is involved. Parameterized queries are the standard defense as they treat user input as data, not executable code, preventing attackers from injecting malicious SQL commands. Options A and D address different aspects of security but don't directly solve the core issue of the vulnerable query construction.
11 / 19
You're reviewing code that fetches data from an external API and displays it on a webpage. The code doesn't perform any sanitization or escaping of the response before rendering it to the browser. During your review, you identify a potential XSS (Cross-Site Scripting) vulnerability. Which of the following comments would be most appropriate to add to the PR description?
During a code review, you notice that the API response is directly inserted into the DOM without any precautions. An attacker could inject malicious JavaScript code into the API response, which would then execute in the user's browser when they view the webpage.
The correct answer (B) highlights the critical need for input sanitization and escaping before displaying data received from external sources. This directly addresses the XSS vulnerability by preventing malicious scripts from being injected into the DOM. Options A, C, and D are irrelevant to the immediate security concern identified during the code review – they focus on performance or basic integration aspects without tackling the core vulnerability.
12 / 19
PR Description:
"Implemented new user profile endpoint. Uses a simple POST request to update user details."
During code review, you notice the endpoint doesn't validate the input 'email' field against a standard email format. You also observe that it directly stores the raw string value into the database without any sanitization or escaping. Which of the following comments would be most appropriate to add to the PR description?
Option A: "Great job on implementing the user profile endpoint! This is a solid foundation for future enhancements."
Option B: "Please ensure input validation is implemented for the 'email' field to prevent potential injection attacks. Consider using regular expressions or a library to validate email format before storing it in the database."
Option C: "The endpoint successfully updates user profiles. No further action required at this time."
Option D: "This implementation is highly scalable and will handle a large number of concurrent users without performance issues."
The correct answer (Option B) addresses the immediate security risk. Simply stating that input validation should be implemented highlights the vulnerability - specifically regarding injection attacks due to the lack of sanitization on user-provided data before storing it in the database. Options A and C are overly positive and don't address the core issue, while Option D focuses on scalability which is irrelevant to this particular comment. A good code review comment should flag potential risks alongside a suggestion for remediation.
13 / 19
' OR '1='1 and drop the entire table. Please use parameterised queries or a prepared statement."The correct answer focuses on escaping user inputs before using them in an SQL query. While escaping is a good practice, it's not sufficient to mitigate SQL injection vulnerabilities when string concatenation is involved. Parameterized queries are the standard defense as they treat user input as data, not executable code, preventing attackers from injecting malicious SQL commands. Options A and D address different aspects of security but don't directly solve the core issue of the vulnerable query construction.
14 / 19
You're reviewing code that fetches data from an external API and displays it on a webpage. The code doesn't perform any sanitization or escaping of the response before rendering it to the browser. During your review, you identify a potential XSS (Cross-Site Scripting) vulnerability. Which of the following comments would be most appropriate to add to the PR description?
During a code review, you notice that the API response is directly inserted into the DOM without any precautions. An attacker could inject malicious JavaScript code into the API response, which would then execute in the user's browser when they view the webpage.
The correct answer (B) highlights the critical need for input sanitization and escaping before displaying data received from external sources. This directly addresses the XSS vulnerability by preventing malicious scripts from being injected into the DOM. Options A, C, and D are irrelevant to the immediate security concern identified during the code review – they focus on performance or basic integration aspects without tackling the core vulnerability.
15 / 19
During a Slack conversation with the team lead, Alex mentions that he's added a new feature to the API endpoint for processing user orders. He says: 'I just concatenated the order details directly into the SQL query – it's simple and fast!' What is the most appropriate response you should provide?
Alex's approach is extremely risky. Directly concatenating user input into SQL queries creates a significant vulnerability to SQL injection attacks. The correct response highlights the core issue and emphasizes the need for secure query construction techniques like parameterized queries or prepared statements. Option A is inappropriate as it doesn't address the security risk, and options C & D are misinterpretations of the problem.
16 / 19
PR Description:
"Implemented new user profile endpoint. Uses a simple POST request to update user details."
During code review, you notice the endpoint doesn't validate the input 'phone' field against a regular expression for phone number format. Complete the security comment:
While rate limiting is often important, the primary security concern here is improper input validation. Failing to validate the 'phone' field against a regular expression allows for malicious users to inject characters that could compromise the application or lead to unexpected behavior. Option A directly addresses this vulnerability by suggesting a necessary validation step.
17 / 19
You're reviewing code for a web service that receives JSON data from an external source. The code parses the JSON and then uses the values directly in a shell command without any escaping or sanitization. What's the MOST likely security risk involved?
This scenario presents a classic Command Injection vulnerability. Parsing untrusted JSON and directly using its values within shell commands without proper sanitization allows an attacker to inject arbitrary commands into the system. This can lead to complete compromise of the server. XSS is relevant for web browsers, DoS affects service availability, and information disclosure is a related concern but not the primary risk here.
18 / 19
Standup Update:
'I've finished implementing the new password reset feature. I just used a simple string replacement to update the user's password in the database.'
What is the most important security comment you should add to this update?
The string replacement method is highly vulnerable to SQL Injection. Directly manipulating the password in a database query without proper sanitization allows an attacker to inject malicious code and compromise the entire system. Parameterized queries or hashing functions are industry-standard practices for secure password management.
19 / 19
You discover a PR where a developer is logging all API requests to a file on the server. What's the primary security concern raised by this practice?
Logging all API requests exposes sensitive information like user credentials, API keys, and potentially personal data. This information can be exploited by attackers to gain unauthorized access or launch further attacks. It's crucial to redact or mask sensitive data in logs to maintain security.
Continue learning:
Security Vocabulary →
Frequently Asked Questions
What does the "Security Review Comments" exercise practise?
Practice flagging security issues in code reviews: hardcoded credentials, SQL injection, missing auth. 2 advanced exercises with real-world examples.
How many questions are in this exercise?
This exercise has 19 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Advanced. If the vocabulary feels difficult, browse the Code Review Language category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Security Review Comments" part of a larger series?
Yes — it's one exercise in the Code Review Language category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Code Review Language category page for related exercises, or browse the main Exercises hub for other IT English topics.