Manual or assisted review of source code to identify vulnerabilities, logic bugs, code smells, and violations of security best practices. Includes analysis of input validation, credential management, authentication, authorization, attack surface, CI/CD pipeline integration, and remediation guidance on modern languages and frameworks.