Code review
Reads the change the way a reviewer does: what it is for, what it touches, and where its logic, conventions or security fall short.
When: On every pull request, after the automated checks pass, so reviewers spend attention on what the checks cannot see.
VA06 tactic
10 techniques
30 sub-techniques
not detectable from CI configuration; no usage counts
| ID | Technique | Description | Sub |
|---|---|---|---|
V1032 |
Change intent extraction | States what the change is meant to do, from title, description, commits and linked ticket, so every later check can ask whether a finding is in scope. | 2 |
V1033 |
Review context retrieval | Collects what a reviewer needs beyond the diff: callers, definitions, related tests, docs and repository rules. | 3 |
V1034 |
Agentic exploration | An agent with read, search and run tools investigates a change: follows a suspicion across files, runs code, and returns findings with evidence. | 3 |
V1035 |
Logic and correctness review | Reads the change for wrong behaviour: off-by-one, inverted conditions, missed error paths, broken invariants, race conditions. | 3 |
V1036 |
Convention and guideline review | Checks a change against the repository's written rules: style guides, AGENTS.md, architecture decisions, naming conventions. | 3 |
V1037 |
Reviewers learned from past reviews | Mines a repository's review discussions for recurring feedback and turns each cluster into a reusable review instruction. | 4 |
V1038 |
Security-focused review | A reviewer that reads for exploitable behaviour across files: authorization gaps, injection through helpers, unsafe trust between services. | 3 |
V1039 |
LLM application security review | Reviews code that calls models for the OWASP Top 10 for LLM applications: prompt injection, output handling, excessive agency, unbounded consumption. | 3 |
V1040 |
Review question checklists | A fixed bank of questions a reviewer must answer for a kind of change, ranked so the most relevant ones are asked first. | 3 |
V1041 |
Reviewer routing | Chooses which specialist reviewers, human or automated, apply to a change based on its files, topics and history. | 3 |