Following up on your own review

The author changed code because you asked them to. That code has had no review. On the last one of these, all four original findings were closed and three of the six bugs that remained were created by the fix.

So the job is not "check my findings are closed." It is that plus reviewing a fresh commit that nobody has looked at, written under pressure to satisfy you.

Before reading the diff

Find the boundary. Your prior review has a submission timestamp; commits after it are code you have never seen. gh api .../reviews gives the timestamp, git log gives the commits.

Then classify every bug you find, using git log -S'<construct>' <base>..HEAD rather than reading the diff and guessing: