Security review exercises

Security review exercises ask learners to identify a trust boundary, name the risk, and choose a safe default. They should review realistic snippets or flows rather than memorise a checklist.

Practical Example

<?php

declare(strict_types=1);

$review = [
    'uses prepared statements' => true,
    'escapes HTML output' => true,
    'checks authorization' => false,
];

foreach ($review as $item => $passed) {
    echo ($passed ? '[x] ' : '[ ] ') . $item . PHP_EOL;
}

// Prints:
// [x] uses prepared statements
// [x] escapes HTML output
// [ ] checks authorization

Security review exercises should ask learners to spot a missing control, explain the risk, and change the smallest amount of code needed to close the gap.

Cover HTML output, SQL, authentication, authorisation, CSRF, uploads, file paths, secrets, logging, and outbound requests across the exercise set.