A development team is finishing a new payment module and wants to find insecure coding patterns and logic flaws, such as missing authorization checks, before the code is built and released. No test or production environment is running the module yet. Which vulnerability identification method fits this requirement?

Source code review examines the application's code directly, either manually or with tool assistance, to identify flaws such as missing authorization checks, unsafe input handling, hardcoded secrets, and business logic errors. Because it works on the code itself, it can be done before anything is compiled, deployed, or reachable, which is exactly when fixes are cheapest. Reviewers focus on high-risk paths in a payment module: authentication, authorization decisions, and how amounts and identifiers are validated. A network vulnerability scan probes running hosts for known vulnerable services and versions; it needs a deployed target and rarely detects logic flaws in custom code. A bug bounty program relies on outside researchers testing a live, reachable system, so it cannot begin before release. A penetration test likewise exercises a running environment and, in this scenario, would occur only after launch, which defeats the stated goal of finding issues first. Exam caveat: static code analysis tools automate part of this review, but human review still catches logic and authorization flaws that pattern matching misses. Operational check: require a documented review of security-sensitive functions as a merge condition and track findings to closure before the release branch is cut.