How do I learn to do secure code reviews?

Ironically, this is something I struggle with a lot as an AppSec Engineer. When a developer includes me in the design and planning phase of a feature, I usually know which specific things to check for in a PR. The worst developers add me as a code reviewer right before the feature is ready to ship. So I'm looking at a PR with tons of code and no context, wondering what the hell I'm supposed to review. I check for …

appsec check code cybersecurity design developer developers engineer feature learn lot planning reviews secure code things