This session explores how a security tester approaches an application by reading and understanding its source code. Instead of focusing only on tools or automated scans, the talk walks through the thought process used to identify risky assumptions and trust boundaries in real codebases. A vulnerable lab environment will be used to demonstrate how small logic mistakes can lead to serious security issues. The session emphasizes methodology over exploitation, helping developers understand how attackers think while reviewing code. Attendees will gain practical insight into common patterns that introduce vulnerabilities. The goal is to build a stronger connection between secure development and real-world offensive security techniques.