This is one of many processes. Roughly, this is how we review our code libraries.
Here, part of what checking that code looks safe is the presence of strong unit tests. Unit tests strengthen the codebase. It may take three times longer to use pure TDD. We suggest that there is a middle ground. We are not even suggesting that ever core business requirements has a set of unit test. Instead, we say that any method that saves to the database needs at least two unit tests, one for pass and one for fail. We do not advocate null tests as such because good client side scripting should not allow null conditions to be passed to the web server. Of course, this is all fair and well when we are talking about websites that live as part of an intranet where users are not expected to be able to turn off JavaScript. There should be null validation on the server but we don't want to explicitly test for it in unit tests.
