Training Module - Secure Pull Request
This example assumes a development environment strongly supported by automated tools, while keeping final responsibility for decisions and practices with the teams involved.
🎯 Objective
To equip developers to:
- Write Pull Requests with minimum security criteria applied
- Identify bad practices in code submitted by colleagues
- Justify security decisions directly in the PR
📋 Prerequisites
- Basic experience with Git and the Pull Request flow
- Previous participation in at least 1 active sprint
- Knowledge of the internal code standards (naming, logging, validations)
🧪 Session format
| Block | Duration | Objective |
|---|---|---|
| Introduction | 5 min | Frame the importance of the secure PR for the development cycle |
| Positive example | 10 min | Review a real or simulated PR with good practices |
| Example with flaws | 15 min | Identify bad practices, omissions and validation failures |
| Guided review | 10 min | Apply the checklist and write improvement comments |
| Quiz or validation | 10 min | 5 questions or a quick consolidation challenge |
💡 The session may be synchronous (training, group peer review) or asynchronous (exercise done at one's own pace with later review).
📦 Required materials
- Two real or simulated PRs (one exemplary, one with flaws)
- Internal secure review guide (e.g.
checklist-pr-seguro.md) - Quiz platform (Kahoot, LMS, Markdown with manual validation)
- Internal channel for sharing and discussion (e.g. Confluence, GitHub Discussions)
✅ Completion criteria
- Active participation in the session or delivery of the exercise
- Passing the quiz (minimum 80%)
- Submission of a real PR with explicit security justifications (e.g. input validation, logging, permission control)
🔗 Cross-references in the SbD-ToE
| Chapter | Relevance |
|---|---|
| Chapter 6 - Secure Development | Direct application of requirements EX-REQ-114, EX-REQ-115 and EX-REQ-118 |
| Chapter 2 - Security Requirements | Integration with user stories that carry security criteria |
| Chapter 13 - Training and Onboarding | May be part of the training track for the Developer profile |
Illustrative identifiers (EX-…); they do not correspond to the Ch. 02 Requirements Catalogue.
🧭 Operational recommendations
- Repeat this session fortnightly with new examples
- Share the “PR of the week” internally as an educational model
- Create a repository of exemplary PRs (good and bad) for consultation and discussion
- Link the module to permissions: e.g. devs may only approve after completing this module
✅ Consolidated learning about secure code review significantly reduces the introduction of vulnerabilities and accelerates the maturity of the technical teams.