What it means
Review can combine automated analysis with human inspection focused on the application's architecture, threat model, language, framework, and high-risk changes.
Why it matters
Code review can find design and implementation issues before deployment and provide context that broad automated scans may miss.
Practical focus
- Prioritize security-sensitive components and changes
- Use the threat model and requirements to guide review
- Combine automated findings with manual reasoning
- Track remediation and verify the final change
Common mistakes
- Reviewing only style and syntax
- Treating static-analysis output as proof
- Ignoring infrastructure and policy-as-code
- Approving large changes without enough context
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: