CGI interview question

How would you conduct a security code review?