The Universal Code Review Framework

Phase 1: Normalization & Triage

Before you can understand the logic, you must make the code readable and identify where to focus your attention.

• Format the Code: Run it through a deobfuscator, beautifier, or pretty-printer. Fix indentation and variable spacing so your eyes can scan it naturally.
• Map the Landscape: Skim the file to identify the main structural blocks—functions, classes, and global variables.
• Identify High-Interest Targets: Look for keywords related to:
  • Network/I/O: HTTP, fetch, XML, socket, read, write.
  • Security/Auth: crypto, hash, token, secret, admin, password.
  • Execution: eval, exec, run, system.
  • Data Serialization: JSON, parse, stringify, xml2js.

Phase 2: Primitives & External Research

Never assume you know what a built-in function does if you haven't seen it before.

• Isolate Unknowns: Highlight any classes, methods, or APIs that you do not immediately recognize.
• Consult the Docs: Search official documentation (e.g., MDN for JavaScript, Python Docs, Microsoft Learn for C#) to understand the intended behavior of those unknowns.
• Key Question: "What is this specific built-in function designed to do, and what parameters does it accept?"

Phase 3: Execution & Data Flow Analysis

Trace the path of the data step-by-step. Go line-by-line through the functions you identified as high-interest.

• Trace Inputs: Where does the function get its data? (User input, hardcoded variables, DOM elements, URL parameters?)
• Trace Outputs/Actions: What does the function do with that data? (Sends it to a server, writes it to the screen, stores it in a cookie?)
• Identify the State: Does this function expect certain conditions to be met (e.g., if (isAdmin)) before it executes?
• Key Question: "If I control the input, how far into this function can I push my data, and where does it ultimately end up?"

Phase 4: Contextual Mapping (The "Why")

Code does not exist in a vacuum. You must figure out how it ties into the broader application.

• Search for Triggers: Use Ctrl+F (or grep) across the entire codebase to find where this function is actually called.