  To avoid software vulnerabilities, organizations are shifting security to
earlier stages of the software development, such as at code review time. In
this paper, we aim to understand the developers' perspective on assessing
software security during code review, the challenges they encounter, and the
support that companies and projects provide. To this end, we conduct a two-step
investigation: we interview 10 professional developers and survey 182
practitioners about software security assessment during code review. The
outcome is an overview of how developers perceive software security during code
review and a set of identified challenges. Our study revealed that most
developers do not immediately report to focus on security issues during code
review. Only after being asked about software security, developers state to
always consider it during review and acknowledge its importance. Most companies
do not provide security training, yet expect developers to still ensure
security during reviews. Accordingly, developers report the lack of training
and security knowledge as the main challenges they face when checking for
security issues. In addition, they have challenges with third-party libraries
and to identify interactions between parts of code that could have security
implications. Moreover, security may be disregarded during reviews due to
developers' assumptions about the security dynamic of the application they
develop.
  Data and materials: https://doi.org/10.5281/zenodo.6875435
