8 proven code review best practices for developers

Security code review is a process for checking code for how well it guards against external threats. The code can have inherent security weaknesses that compromise the application or surrounding code blocks. Peer reviews are a manual process that complement automated testing methods for comprehensive security coverage. A secure code review can identify security weaknesses and help to identify errors in the code logic tied to how an application works. This type of review protects the application from data and intellectual property loss, which could impact the company’s revenue and reputation.

One of the best ways to improve the quality and security of software is to implement a formal process for manual code reviews. Given the potential errors during code writing, using several fresh eyes with complementary expertise can uncover mistakes the original programmer may never notice. Moreover, while humans are prone to error on their own, a group of experts may catch a bug or security flaw within the code that automated code review tools may miss.

For all the benefits of having a peer code review, it is sometimes challenging to have a peer group convene and rapidly execute the task at hand. To address that point, defining code review practices can help guide the process to get to the desired result: high-quality, secure code. Here are eight code review guidelines that you can implement into your company's software development process.

1. Add comments during source code during creation

The first practice is for developers to use non-functional comments in sections of the code to tell reviewers the intent of a code block. Comments help communicate why the developer made the decision or change they did without the review team having to guess. When executed well, experienced reviewers should be able to use comments to understand the purpose and methodology of the entire code sequence. Moreover, having a style guide and enforcing it ensures readability for the whole team.

2. Don't assume something works without testing

Developing code requires iterations of trial and error. A developer writes some lines, compiles the code, and it doesn't work. Testing the functionality and output of the new code sections can drastically reduce review time later. In addition, it is much easier to correct a small portion of code knowing the rest of the code functions appropriately. One tactic called test driven development (TDD) is to write unit tests before you implement the code. This approach serves as a preliminary check for specific function blocks, leaving the reviewers to focus on integrating these functions in the remainder of the code.

3. Run test suites on proposed code

One approach to validating a specified set of procedures is to use automated test suites to write unit tests for each code block. The test suite presents a collection of known functions and evaluates the code against a known positive result. Another tool to assess how the code performs specific actions, test suites accelerate the validation of sections of code that perform one or more tasks that the test suite prescribes. A failure can point the developer to a specific area they need to modify.

4. Ensure pull requests are small and with a singular purpose

Pull requests (PRs) refer to a standardized process for requesting peer code reviews. When the developer completes the initial code change, the PR triggers the review process. The developer should create PRs with specific instructions for the reviewers to increase the efficiency and speed of the manual code review. The more elaborate the PR, the longer the review can take, which risks the reviewer missing the PR's primary objective. In fact, the ideal size of a PR is less than 250 lines because reviewers can discover 70-90% of defects in under an hour.

5. Always run automated code checkers

Before the peer review, the developer can employ code review tools like scanners, automated code checkers, or static code analyzers to evaluate the quality of a codebase after changes were made. These tools cover overt formatting mistakes like errors in function names or spacing issues. Scanners or linters have defined guardrails and operate like spellcheck for the code to find errors quickly. Employing these tools removes this work from the manual peer review process, allowing the code review team to focus on stylistic or interpretive errors.

For example, Java code review tools can find bugs and security issues within Java code and offer actionable advice that enable developers to quickly remediate them. Snyk Code offers code quality recommendations directly from your IDE, providing a frictionless developer experience.

6. Review all code and PRs

As the code is sequential, reviewers need to assess the entire code and PR set for cohesiveness. Changing one section can drastically affect downstream subroutines, so the code peer review team needs to consider the whole code and all PRs when evaluating it. Larger, more substantial PRs naturally garner more attention, however, an error in a small PR can have effects even more devastating than that of a set of flaws with an extensive PR.

7.Set limits for review time and code lines checked

Reviewing code is a time-consuming and tedious (though critical) process. To that end, it is essential to limit the amount of time a reviewer or team spends on the details of each line of code. A few examples of best practices in this area include ensuring the team members don't spend more than an hour on code reviews or that the team does not review more than several hundred lines in a given number of hours. This philosophy sets expectations for the code review team and ensures that they meticulously check the part of the code tied to the PR. By organizing code reviews in an efficient way for the whole team, developers can get valuable feedback and quickly improve the quality of their code.

8. Conduct a security code review

Another best practice for code reviews is to conduct a secure code review. While automated tools check the code for spacing or naming errors and compare it with known standard functions, manual reviews assess the code's style, intent, and functional output. The third type of assessment is a security code review, which reviews the developer's code for security robustness.

The code can have inherent vulnerabilities that compromise the application or surrounding code blocks. A secure code review can identify these vulnerabilities and also aid in identifying errors in logic tied to how an application works. The developer must be able to write the code in an environment that guards it against external attacks that can have effects ranging from intellectual property theft to revenue loss to data loss

The good news is that there are existing static application security testing (SAST) tools  — like Snyk Code — that can catch vulnerabilities before they hit code review or during code scanning, as well as  secure coding best practices that can protect the source code and enable an efficient secure code review. Examples include limiting access to the code, enforcing strong encryption, and implementing Secrets Management to protect passwords and hardcode from broad sharing.

Final takeaway for how to do a code review

Developers can continue refining and optimizing their code indefinitely, but they still may not catch every error or security flaw. By implementing a peer code review process, development teams can ensure their software is properly tested before pushing code to production. Conducting a code review with a combination of an automated code review, manual peer review steps, and secure code review practices is the most efficient way to ship high-quality, secure code quickly.

Visit our Security Resources page to learn about Snyk's options and tools to help developers create accurate, secure code.