Following are the main areas to look for security code review:
- SQL injection
- CSS
- Data Access
- Input/Data Validation
- Authentication
- Authorization
- Sensitive data
- Unsafe code
- Unmanaged code
- Hard-coded secrets
- Poor error handling
- Web.config
- CAS
- Cryptography
- Undocumented public interfaces
- Thread Racing problems
For details look into Security Engineering Explained by MS Patterns and Practises !!