Over the past years, web applications have significantly increased the web presence of various industries. The threat landscape had evolved to become a more dangerous and complicated environment. In the Asia Pacific region, 93 percent of breaches are attributed to web application attacks that compromise valuable and sensitive information from various organizations. Hence, it is vital to ensure that vulnerabilities in web applications must be addressed by adhering to secure coding practices in web application development. The purpose of this study is to perform secure code analysis to investigate undergraduate students’ level of adherence to secure coding practices and implementation of application risk controls in their IT capstone projects, ensuring that the systems being developed are secure. As a result, based on the evaluation of Capstone Projects’ level of compliance with secure coding practices and implementation of application risk controls, undergraduate IT students generally conform to secure coding practices in web application development. However, the researcher discovered a knowledge gap among students, who do not adhere totally to secure coding practices and proper security configurations in the development of web applications, which could lead to a compromised system that puts data at risk. Moreover, the result of the study implies that using the hybrid approach in conducting secure code analysis could uncover all security problems in the developed web applications. Thus, performing a hybrid code analysis approach could significantly improve the overall security posture of the developed web application systems, ensuring that data is secured.