Code review is too little too late. What is needed is design review: how will or how does this thing work? How can you be sure it is not hackable? How do you know it will be resilient to failure? How does it deal with concurrent access by different users/clients?