A top-common-issues checklist can be very effective for a project team to decide what to focus on during secure code review. To build a top-common-security checklist, it's suggested to refer to the CWE Top 25. The security team and the project team may take the CWE Top 25 basis and in-house top security issues, based on historical project data, to reach a consensus of the top five security issues.
To summarize in-house top security issues is critical; it's because the CWE Top 25 may not be exactly the same for in-house projects, due to the business background, technology stacks, and the implementation. Once an in-house top-security-issue list is identified, it should also be listed with suggested mitigation approaches. Refer to the following table for what it may look like. The purpose of the table is to give a sample that you may also define the one...