A new mobile application is being developed in-house. Security reviews did not pick up any major flaws, however vulnerability scanning results show fundamental issues at the very end of the project…

An architecture review focuses on high-level design flaws and security principles, which is important but may not identify specific implementation-level vulnerabilities in the code itself that would be found by a scanner or code review.

Risk assessment is a management process for identifying, analyzing, and evaluating risks, but it is not a direct technical activity for discovering vulnerabilities within an application's code.

Protocol analysis involves examining network communication patterns and vulnerabilities in protocols, which is typically performed during network testing or operation and does not directly address application-level code vulnerabilities.

Code review involves systematically examining the source code for programming errors, security flaws, and logic vulnerabilities like injection attacks or insecure data handling. Performing code reviews during the development phase allows for the identification and remediation of these 'fundamental issues' much earlier than late-stage vulnerability scanning, thereby reducing remediation costs and risks.