Static scanners effectively identify known vulnerability patterns like unsanitized inputs and hardcoded secrets. However, they fail to detect logic flaws where correct code performs unintended actions within a specific domain. These overlooked issues surface late in development, becoming more expensive to rectify. Security Review Flow, a new public beta feature, addresses this by scrutinizing code changes from a security engineer's perspective. It traces the intent behind code rather than relying on pattern matching, catching logic flaws before they reach production. Traditional scanners miss vulnerabilities arising from an application's authorization model, data sensitivity rules, and intended workflows. Examples include broken object-level authorization, data exposure of sensitive fields, and business logic errors like completing a checkout without payment. Manual code reviews and penetration tests are costly and don't scale with rapid development. Security Review Flow, part of the GitLab Duo Agent Platform, bridges this gap by reasoning about code's intended functionality. It detects a range of flaws including authorization issues, information disclosure, mass assignment, and race conditions. This tool complements, rather than replaces, existing scanners and human analysis, reviewing code at the point of change for cost-effective fixes. When a merge request is ready, users can request a review from Duo Security Review, which analyzes the diff, surrounding code, and discussion. Findings are presented as diff threads with detailed explanations, severity, and suggested fixes. The review process never automatically approves changes, ensuring human oversight. Security Review Flow is available in public beta for GitLab Ultimate customers across various GitLab platforms.