Read What It Wrote

You don't need to understand every line, but you should know what each file is for. Ask the tool to summarize the project in plain language and to point out anything that handles passwords, payments or personal data.

Checks before you move on

• Can you describe each file in one sentence?
• Are there secret credentials in the code or in browser-visible settings?
• Does the app crash on empty or odd input?
• Does it do anything you didn't ask for?

Worked example

Sam asks the tool to summarize the project. It reports six files and flags that an API key is written directly in one of them. He removes it from the code and rotates it, because a key that has sat in a file or a repository should be treated as exposed. Then he checks whether the key was meant for the browser (publishable) or only for the server (secret).

Common mistakes

• Never opening the files.
• Leaving secret credentials in the code or in browser-visible settings.
• Not testing empty or strange input.

Exercise

Ask your tool to summarize your project and list anything touching passwords, payments or personal data.