WEBVTT

1
00:00:00.650 --> 00:00:06.751
BattleTest reviews code changes for security issues and puts findings beside the affected code.

2
00:00:07.151 --> 00:00:14.127
Start by installing the GitHub App. Choose the repositories it can access, then open a pull request as usual.

3
00:00:16.427 --> 00:00:21.718
In this example, Alex adds an invoice endpoint to the Wonderland billing application.

4
00:00:22.118 --> 00:00:30.822
The endpoint requires a signed-in user. But its database lookup checks only the invoice ID. It does not check which account owns that invoice.

5
00:00:33.122 --> 00:00:37.111
BattleTest flags the missing account check in a review comment.

6
00:00:37.511 --> 00:00:44.487
The comment explains the problem: a user who obtains another account's invoice ID could retrieve that invoice.

7
00:00:44.887 --> 00:00:51.245
The engineer can read the affected code and the security explanation together, inside the pull request.

8
00:00:53.545 --> 00:00:58.857
The proposed correction checks both the invoice ID and the signed-in user's account.

9
00:00:59.257 --> 00:01:06.169
An engineer still reviews and applies the change. The suggestion is part of the review, not an automatic merge.

10
00:01:06.569 --> 00:01:15.081
Code review checks the implementation. To investigate how the running application behaves, use BattleTest's live application testing.