Code review practice means deliberately reading and evaluating source code, not just running a scanner against it  to build the pattern recognition needed to spot injection flaws, broken access control and authentication mistakes.