Skip to main content
All guides

What to agree before a code review

Choose the code to examine, the question to answer and what the findings should include.

Related service: Code & Configuration Reviews

Name the question

“Review our application” is too broad to quote or evaluate. Start with the decision the review should support. For example: can a new administrator role be added without giving every user access to the same records?

Write down the expected behaviour and the part you are uncertain about. That gives the reviewer a concrete question and gives you a way to judge whether the report answers it.

Set the boundary

Agree the repository, revision and relevant configuration. List the included flows, such as signing in, changing a role and viewing a record. Name the environments the reviewer may inspect and the access they will receive.

Choose a reviewer with relevant experience. A review of selected code does not establish that the whole application, its infrastructure or its operating processes are secure. If you need a separate penetration test or a certification assessment, specify that as different work.

Record what is excluded. An unfamiliar service, missing configuration or inaccessible dependency should appear as a limit in the report.

Agree the findings format

Ask for findings that a developer can act on. Each finding should identify the relevant code or setting, the observed behaviour, the expected behaviour and the likely consequence.

The report should distinguish confirmed findings from questions that need more access or investigation. Priorities should reflect the application’s use, the information involved and the people who can reach the affected behaviour.

For the administrator-role example, a useful finding points to the permission check and explains which user can perform which action. “Improve security” does not tell the developer what to change.

Separate review from repair

Agree whether the fee covers the report, a discussion of the findings, code changes or a later recheck. These are different amounts of work.

After a repair, check the original finding against the revised code and test the affected behaviour. Keep unresolved findings and any accepted limitations visible to the person responsible for the system.

A scope you can send to a reviewer

This is a fictional brief for a small application. Adapt the boundaries to your system before sharing access.

We are adding a manager role. Review whether a manager can read and edit only records belonging to their own organisation. Include the API permission checks and the related configuration at the agreed commit. Use a test environment with synthetic records. Exclude payment processing and infrastructure testing. Report the affected paths, reproduction steps, consequence and suggested repair. Quote implementation and rechecking separately.

Attach a role list and an example of who should see which record. Include cases where access must be refused. Ask how the reviewer will handle secrets, retain working copies and remove access after the work ends; avoid sending production credentials in the first email.

For a developer’s reference on the review process, Google’s engineering guidance explains what to look for in a code review. That guidance covers reviewing code changes; it does not turn a scoped review into a security certification.

See the scope of Drevhe’s Code & Configuration Reviews.