River
Y CombinatorBacked by Y Combinator
Log InStart Free
FREE TEMPLATE

Secure Code Review Checklist Template

Three documents and two sheets that build a review checklist from the security findings this codebase has actually had more than once.

Edit with AIDownload (.docx + .csv)

Free download  ·  No account needed

What you get

Pack of 5 files: 3 documents, 2 spreadsheets

Secure Code Review Checklist Template
  • Review ChecklistDocument
  • Developer GuidanceDocument
  • Escalation CriteriaDocument
  • Finding Pattern RegisterSpreadsheet
  • Review CoverageSpreadsheet

Search for a secure code review checklist and every result is organized the same way: authentication, injection, secrets, cryptography, dependencies, one section per category, built to cover any application in general. The canonical standard is shaped the same way. OWASP's Application Security Verification Standard, version 5.0, now holds 345 requirements across 17 chapters. Nobody runs the whole thing on a pull request, so a team's real checklist is a shortened version, and the shortening is usually done once, by category, and rarely checked against what has gone wrong since.

Shortening it by recurrence is different from shortening it for length alone. A 2022 study on checklist-based secure code review, published at ICSE, cites literature recommending a checklist stay concise, under one page, and reduced OWASP's own Code Review Checklist to 22 items to meet that guidance for its experiment. This pack applies the same discipline to your own history instead: a root cause counts once it recurs in a second pull request or report, and one severe finding gets fixed without being promoted to a permanent line.

Halyard Systems, an illustrative B2B scheduling platform in the worked example, mined 96 findings from two years of review comments, pentest reports and incident postmortems. Six root causes recurred, accounting for 88 of the 96, and became the checklist; the other eight never repeated and stayed off it. Checklist completion on flagged pull requests rose from 27.8 to 88.2 percent after the switch, and new instances of the largest pattern, missing authorization, fell from 9 to 2. The vulnerability triage pack covers what a scanner finds; this one covers what a reviewer catches first.

The checklist that got shorter and started actually getting run

The Finding Pattern Register sheet and the Review Coverage sheet it is checked against.

Secure Code Review Checklist Template
RiverFinding Pattern Register

Finding Pattern Register

96 findings mined from two years of code review comments, pentest reports and incident postmortems at a fictional scheduling platform, Halyard Systems.

Root causeCount% of 96ComponentRecurred?Promoted?
Missing per-resource authorization3435.4%API layerYesItem 1
Hardcoded secret in diff1919.8%API + infra scriptsYesItem 2
Unparameterized query/command1414.6%API + data accessYesItem 3
Sensitive field logged plaintext1111.5%API layerYesItem 4
Unescaped rendering (stored XSS)66.2%FrontendYesItem 5
SSRF via caller-supplied URL44.2%API layerYesItem 6
8 one-off root causes, never repeated88.3%MixedNoNot promoted

88 of the 96 findings, 91.7 percent, trace to just 6 recurring patterns. Those 6 are the entire checklist. The other 8 never showed up a second time and stayed off it, no matter how severe the single instance was.

The authorization pattern alone is 35.4 percent of everything ever found, more than the next two categories combined.

RiverReview Coverage

Review Coverage

Checklist completion on security-sensitive pull requests, 12 months before and after switching to the derived checklist.

PeriodChecklist in usePRs flaggedCompletedRateNew Item-1 findings
Before9-item generic list1875227.8%9
After6-item derived list20317988.2%2

Completion rose from 27.8 to 88.2 percent after the checklist got shorter and more specific. New authorization findings, the pattern it was built to catch first, fell from 9 to 2, a 4.5x drop.

More PRs got flagged in the after period, not fewer, so the completion jump is not an artifact of reviewing less.

Edit with AI

What's in the pack

01

Review Checklist

Six items, each one a pattern that has recurred at least twice, organized by the language and component type it actually occurs in rather than by category alone.

02

Developer Guidance

When the checklist applies, what a reviewer does when an item flags something, and how a newly recurring pattern gets promoted onto the list later.

03

Escalation Criteria

Which findings block a merge outright and which are eligible for a tracked follow-up with a named owner and a deadline, so nobody decides that case by case.

04

Finding Pattern Register

Every past finding sorted into a root cause, with the count, the component type, and whether it cleared the recurrence bar that earns it a place on the checklist.

05

Review Coverage

Tracks how often the checklist actually gets run to completion, split before and after it changed, plus whether the pattern it targets most is still recurring.

How to use it

  1. 1

    Send your history

    Code review comments tagged or flagged as security issues, past penetration test reports, and incident postmortems, covering at least the last year.

  2. 2

    Sort every finding

    River sorts each one into a root cause and checks whether it has recurred across more than one pull request or report, using the space rule's definition.

  3. 3

    Draft the checklist

    Only patterns that cleared the recurrence bar become checklist items, organized by the language and component type each one actually occurs in.

  4. 4

    Track whether it gets used

    The Review Coverage sheet checks completion rate and the targeted pattern's recurrence going forward, so a promoted item is a checked result, not an assumption.

Frequently asked questions

Is this template free?

Yes, no account and no card needed for the download. Edit with AI is the optional half: it reads your review history and sorts findings into the patterns this checklist is built from. Every other pack is in the template library.

What format are the downloaded files?

Three documents as Word files and two sheets as CSVs, in one zip. The sheets ship with the Halyard Systems rows in place, so the recurrence rule and the before-and-after comparison are visible before you replace them with your own data.

We already have a secure code review checklist. What does this replace?

Whatever generic, category-based list is currently in use. This pack does not add a second checklist alongside it; it sorts your own review history first, so the result reflects what your codebase has actually gotten wrong rather than every category a standard covers.

What if we don't have two years of review history?

A shorter window still finds a real pattern once a root cause recurs. A single severe finding is left off the checklist rather than promoted on one occurrence, since the method depends on a second instance as the signal, not on how serious the first one was.

How is this different from the vulnerability triage pack?

Where the finding comes from. The vulnerability triage and remediation pack works from a dependency scanner's output, findings a tool already flagged. This pack works from what a human reviewer or a pentest found, the things a scanner does not check at all.

Does this replace a penetration test?

No. A pentest still tests what actually shipped. This pack uses past pentest findings as one input to the checklist, and the penetration test response pack is what turns a new pentest report into a remediation plan once one lands.

What happens when a new kind of finding shows up?

It gets logged, not added to the checklist immediately. A pattern earns a line once it recurs in a second pull request or report; a single occurrence gets fixed on its own merits without changing the list a reviewer runs through every time.

Sources

  1. GitHubASVS/5.0/en/0x05-For-Users-Of-4.0.md at master (opens in a new tab)
  2. eprints.gla.ac.ukLess is More: Supporting Developers in Vulnerability Detection during Code Review (opens in a new tab)

Written by

Chandler Supple

Co-founder & CEO, River

Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.

LinkedInGitHubX

Reviewed by

Brian Joseff, Co-founder, River

LinkedInX

More free templates

Information Security Policy Set Template

Free information security policy template set: every sentence traced to the contract, control or statute that requires it. Six documents and five sheets.

Penetration Test Response Template

Turn a pentest report into a remediation programme keyed on root cause, with Closed split into the three claims it really is. Free installable pack.

Security Incident Response Plan Template

Free security incident response plan template: one discovery timestamp computes every notification deadline you owe, by trigger event and clock unit.

SOC 2 Control Narrative Examples

Free SOC 2 control narrative examples plus an evidence register that dates every artifact against its source system's own retention window.

Find the six things your own codebase actually keeps getting wrong

Take the Word documents and CSV sheets blank, or open this exact pack in River and send it your review history.

Edit with AI