---
title: "How To: Perform a Security Code Review for Managed Code"
url: "https://osherove.com/blog/2005/11/3/how-to-perform-a-security-code-review-for-managed-code.md"
canonical: "https://osherove.com/blog/2005/11/3/how-to-perform-a-security-code-review-for-managed-code.html"
published: "2005-11-03T11:31:00"
updated: "2005-11-03T11:31:00"
tags: []
author: "Roy Osherove"
description: "Recently I was asked by one of my clients to do a security review of some of their code. I'm no security expert (and stated this to them) but I was still requested to do this. Having gotten this task I decided to look…"
usage: "Licensed under CC BY 4.0 — reuse, quote and adapt with attribution (Roy Osherove, link to the original page)."
license: "https://creativecommons.org/licenses/by/4.0/"
---

# How To: Perform a Security Code Review for Managed Code

By Roy Osherove November 3, 2005

**Historical article** · Originally published November 3, 2005; technical details may be outdated.

Recently I was asked by one of my clients to do a security review of some of their code. I'm no security expert (and stated this to them) but I was still requested to do this. Having gotten this task I decided to look for lots of sources to do with security. I ended up scratching my head and use the old method of "do what feels right" , that is, try to pretend I was a hacker and see if any of the code could be compromised (lots of web services, queues etc.)

I'm not sure I did a great job, but I learned a lot. If only I had access to this article I'd be more sure of that:

[How To: Perform a Security Code Review for Managed Code (.NET Framework 2.0)](http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGHT000027.asp)

(via [varad](http://weblogs.asp.net/Varad/archive/2005/11/02/429314.aspx))


---

## About the author

**Roy Osherove**: Senior Solutions Architect at AWS working on AI for production and AI-driven development; author of The Art of Unit Testing and Elastic Leadership, with about 20 years of consulting and training on unit testing, TDD, team leadership and continuous delivery.

### Sites

- [RobotPaper](https://robotpaper.ai/): This blog: AI patterns and anti-patterns, AI and coding agents, and engineering leadership.
- [osherove.com](https://osherove.com): Roy's personal site. Author of The Art of Unit Testing and Elastic Leadership; consulting and training on unit testing, TDD, team leadership and continuous delivery, plus about 20 years of blog posts.
- [The Art of Unit Testing](https://www.artofunittesting.com): The Art of Unit Testing, 3rd Edition (Manning): readable, maintainable, trustworthy unit tests, plus TDD workshops in C#, JavaScript, Java and Kotlin.
- [5whys.com](https://www.5whys.com): Roy's writing on software team leadership: self-organizing teams, surviving chaos, learning mode and the Elastic Leadership model.
- [Pipeline Driven](https://pipelinedriven.org): Continuous delivery and DevOps practices: build patterns, pipeline-friendly testing, DevOps metrics and enterprise DevOps.
- [Elastic Leadership](https://www.elasticleadership.com): Elastic Leadership, Roy's framework for software team leaders (survival, learning and self-organizing modes).

### Social

- X: https://x.com/royosherove
- LinkedIn: https://www.linkedin.com/in/osherove/

### Contact

- Contact form: https://forms.gle/jQSx5KoXvrVA1JCK7

### License

Licensed under CC BY 4.0 — reuse, quote and adapt with attribution (Roy Osherove, link to the original page). License: https://creativecommons.org/licenses/by/4.0/