Manual code review is the process of a human expert systematically examining application source code line-by-line to find security vulnerabilities. This method is uniquely effective at identifying complex business logic flaws, insecure use of cryptographic functions, and other subtle errors that automated tools may miss. It is frequently conducted after initial automated static and dynamic analyses have been completed to validate their findings and perform a deeper, more context-aware investigation of the codebase.

A. Dynamic Analysis: This technique tests the application in its running state by providing inputs and observing its behavior, not by reviewing the source code itself.

B. Static Analysis: This is typically an automated process (SAST) that scans source code for known vulnerability patterns, often serving as a preliminary step before a manual review.

D. Fuzz Testing: This is a form of dynamic analysis that involves sending malformed or random data to an application to induce crashes or unexpected behavior, not a code review process.

---

1. OWASP Foundation. (2017). OWASP Code Review Guide, Version 2.0. Section 1.3, "Code Review Methodologies." This section distinguishes between manual and automated code reviews, noting that manual review is a "phase where the source code is manually inspected" and is essential for finding flaws missed by tools.

(Available at: https://owasp.org/www-project-code-review-guide/)

2. Viega, J., & McGraw, G. (2001). Building Secure Software: How to Avoid Security Problems the Right Way. Addison-Wesley. In Chapter 8, "Implementing Secure Software: Code Review," the authors state, "Code review is the single most effective technique for identifying security flaws at the implementation level" and describe it as a detailed, line-by-line process that complements other testing.

3. National Institute of Standards and Technology (NIST). (2022). Special Publication (SP) 800-218: Secure Software Development Framework (SSDF) Version 1.1. Section 3.3, Practice PW.8 ("Test Executable Code"). This document describes various testing methods, implicitly positioning manual review as a distinct, in-depth verification activity separate from automated static (SAST) and dynamic (DAST) analysis.