A process for performing security code reviews
Michael Howard · IEEE Security & Privacy · 2006
No one really likes reviewing source code for security vulnerabilities; its slow, tedious, and mind-numbingly boring. Yet, code review is a critical component of shipping secure software to customers. Neglecting it isn't an option