Validate idea of Security Code Reviews

What’s this issue all about?

Validate assumptions around the security code review process.

What questions are you trying to answer?

  • What is the current code review process for security engineers and developers who are dealing with vulnerabilities

What assumptions do you have?

  1. A security-specific code review is necessary to reduce the risk of weaknesses and threats being introduced into the project.
  2. A triage process in the MR is desirable for security reviewers.
  3. The flow prescribed works in real-world applications where vulnerability counts and type can vary.
  4. The language and terms used in these two areas are common to the industry and are carefully considered across multiple areas of the application for a cohesive experience.

What decisions will you make based on the research findings?

IF the general idea is valid work toward a Product discovery will be initiated.

Insights from the research will be baked into the Product discovery work.

Proposed process (high-level)

  1. Validate or dismiss assumptions: Conduct (3-5) contextual inquiry interviews and lite usability testing with the application security team at GitLab focusing on code reviews and their triage process. Assumptions will be validated here.
  2. Analyze and make a decision on next steps:
  • Iterate and Refine: Make changes to the design based on the findings of the study or...
  • Pivot: to another area of opportunity regarding code review and triage if the research is pointing that way. If it is not then we can conclude that the first assumption is wrong and we need to bail.

  1. Validate usability: Conduct a short validation usability study in UsabilityHub with the GitLab audience as well as internal GitLab users. (new issue will be created)

  2. Finalize: Refine the designs with findings from the study, create an MVC and follow-up issues as required. (Product discovery issue)

What's the latest milestone that the research will still be useful to you?

ASAP. Aiming at an early August date to initiate research.

Process & roles

Primary's responsibilities: @andyvolpe
  • Create test plan
  • Draft script
  • Create study materials
    • Wires for usability test created with an accessible link
Support's responsibilities: @loriewhitaker
  • Recruit participants
  • Schedule participants
  • Revise and approve script

Scheduling

Participant Day/Time (UTC) Lead Note taker Link to recording
Edited by Thiago Figueiró