Leo B.
Sample Review routine improved our pull requests
The routine and comment examples made our developers far more confident reviewing security relevant changes.
Secure code review with Semgrep, CodeQL and secret scanning
Review code for security like a specialist, automate the checks with SAST and secret scanning, write custom rules and triage findings without drowning in noise
Created by Jonas Lindqvist
- Updated October 2026
- English
- Advanced
What you will learn
- Run a focused security review of a pull request or service
- Explain how SAST engines find issues and why they produce false positives
- Write, test and maintain custom Semgrep rules
- Run CodeQL analysis and interpret data flow results
- Prevent and respond to leaked secrets with automated scanning
- Build a triage process and metrics that keep findings actionable
Course content
Reviewing code for security
Semgrep in depth
- Video: Running Semgrep locally and in CI 10 min
- Video: Writing your first custom rules 12 min
- Article: Taint mode rules 11 min
- Video: Testing and maintaining rules 9 min
CodeQL
- Video: Setting up CodeQL analysis 10 min
- Article: Reading data flow paths 10 min
- Video: Writing simple CodeQL queries 12 min
- Video: Comparing tools and combining results 8 min
Secrets
- Article: How secrets leak 9 min
- Video: Secret scanning with Gitleaks and push protection 10 min
- Video: Responding to a leaked secret 10 min
- Article: Reducing the number of secrets 8 min
Dependencies and infrastructure code
- Video: Dependency scanning and reachability 10 min
- Video: Scanning infrastructure as code 9 min
- Article: Reviewing container images 9 min
Rolling out at scale
- Video: Security champions and ownership 9 min
- Video: Rolling out tools across many repositories 10 min
- Article: Metrics and reporting 9 min
- Video: Review practice: three real world style pull requests 12 min
- Quiz: Final check 6 min
Requirements
- Comfortable reading Python or TypeScript code
- Familiarity with common web vulnerability classes
- Git and a GitHub account for the CI exercises
Description
Security tools are only as good as the process around them. Many teams switch on a static analysis scanner, receive hundreds of findings, fix a few and then quietly ignore the rest. This course teaches a better approach: manual review skills where they matter most, automation for everything repeatable, and a triage process that keeps the signal high.
What you will learn
- A method for security focused code review: where to look first and what to ask
- How static application security testing (SAST) works, including taint tracking
- Writing and testing custom Semgrep rules for your own code base
- Running CodeQL, reading its results and writing simple queries
- Secret scanning with Gitleaks and platform features, including what to do when a secret leaks
- Triage, suppression with reasons, metrics and rolling tools out across many repositories
How the course works
We work with a realistic multi service sample application written in Python and TypeScript, containing a set of planted security bugs. You will find some by reading code and others with tools, then write rules that would have caught each one automatically. Every rule you write is tested against positive and negative examples, the same way you test application code.
This is an advanced course. You should be comfortable reading code in at least one of the languages and know the common web vulnerability classes, for example from an OWASP Top 10 course.
Who this course is for
- Application security engineers and security champions
- Senior developers and tech leads who review code
- Platform teams rolling out security tooling across an organisation
Instructor
Jonas Lindqvist
Application security engineer helping developers write, review and test secure code
- 4.3 instructor rating
- 28 reviews
- 7,320 students
- 4 courses
- Sample
I sit between development and security teams, reviewing code, tuning scanners and teaching developers how common vulnerabilities actually appear in real code bases.
My courses are written for developers first. We read vulnerable code, exploit it in a safe lab, fix it and add a test or rule so it stays fixed. Examples use Python, JavaScript and Java because that is what most teams I meet write.
I focus on the OWASP Top 10, API security, authentication, and tooling such as Semgrep, CodeQL and secret scanners. My aim is that security becomes part of your normal review, not a separate step at the end.
Student reviews
Moritz A.
Sample Custom Semgrep rules finally make sense
Writing taint rules for our own request wrapper removed most of our false positives in a week.
Adebayo F.
Sample Triage process is the real value
Our backlog of ignored findings is gone. Suppressions with reasons and diff aware blocking changed the culture.
Tim R.
Sample Great secrets response lesson
Rotation first, history later. Clear, practical and exactly what we needed after a leak last year.
Jana P.
Sample Strong but advanced
Excellent CodeQL section. You need solid security knowledge before starting, as the description says.
Esra Y.
Sample Good, heavy on GitHub
Content is accurate. Most CI examples use GitHub, so GitLab users need to adapt a few steps.
Keep exploring
All Secure Development courses
More in Secure Development
$69.99
Enroll now