Peer Code Review to Prevent Security Vulnerabilities: An Empirical Evaluation

Peer code review, as an effective quality improvement practice, has also been considered important for reducing security vulnerabilities. There is a lack of empirical evidence to quantify and support this claim. Therefore, we propose a research plan to analyze mature open source projects to gather empirical evidence regarding the relationship between peer code review and security vulnerabilities. As a proof-of-concept, we analyzed the Chromium OS project and found that reviewers identified potential vulnerabilities in 32 review requests.

I. Introduction

Software inspections, in which developers subject their code to review by peers or other stakeholders to identify defects, are an effective quality improvement practice [1]. Specifically in the security context, McGraw suggests that peer code review is an important practice for detecting and correcting security bugs [2]. For example, expert reviewers can identify code that contains potential security vulnerabilities and help the author eliminate the security flaws or abandon the vulnerable code. Moreover, peer code review can identify attempts to insert malicious code into the codebase. According to McGraw, the longer it takes to detect and fix a security vulnerability the higher the overall cost associated with that vulnerability [3]. Therefore, peer code review can reduce the cost of creating secure software by helping developers eliminate security defects earlier when it is less expensive.