The 3 security bugs I look for most often in code reviews

The 3 security bugs I look for most often in code reviews

Writing code that works is one thing. Writing code that stays secure is another.

While reviewing applications, there are three areas every developer should pay close attention to:

Broken Access Control
Does your API verify whether the logged-in user is actually allowed to access the requested resource?

Improper Input Validation
Are you trusting user input without validating it on the server?

Sensitive Information Exposure
Are passwords, API keys, tokens, or personal data being exposed through logs, API responses, or configuration files?

Security isn't something we should add only before deployment. It should be part of how we design, develop, and review applications.

My advice to developers: Don't just ask, "Does this feature work?"

Also ask, "How could someone misuse it?"
Which security issue do you think developers overlook most often?