Reviewing Code Changes

Reviewing a diff is not auditing a codebase in miniature. The diff shows you what changed but hides what the change means — the caller that now receives untrusted data, the check that used to run, the assumption that no longer holds. Reviewing only the added lines is the standard way to miss the bug.

When to Use

• Security review of a pull request, branch, or commit range
• Pre-commit or pre-merge check on your own changes
• Assessing risk of a dependency bump or config change
• Reviewing an AI-generated change before it ships

When NOT to Use

• Whole-codebase audit — use auditing-code-for-vulnerabilities
• Runtime testing of the deployed change — use the relevant testing skill
• Dependency/CI changes as the main subject — use auditing-supply-chain