Manual review focus areas

- Input validation and sanitization (and where it's missing) - Authentication and session management - Authorization checks (especially in API routes and data access) - Cryptography (custom implementations, key management) - Error handling and information disclosure - Concurrency and race conditions - Deserialization of untrusted data - File operations (path traversal, upload, inclusion) - Database query construction (SQL/NoSQL injection) - OS command execution - SSRF in HTTP client code - XML and YAML parsing - Regular expression DoS (ReDoS) - Business logic flaws (workflow bypass, price manipulation)