Secure Code Review Checklist

TLDR;

What security vulnerabilities is this code susceptible to?
Are authorization and authentication handled in the right way?
Is (user) input validated, sanitized, and escaped to prevent security attacks such as cross-site scripting, SQL injection?
Is sensitive data like user data, credit card information securely handled and stored?
Does this code change reveal some secret information like keys, passwords, or usernames?
Is data retrieved from external APIs or libraries checked accordingly?
Does error handling or logging expose us to vulnerabilities?
Is the right encryption used?

Are sessions handled correctly?
Are failure messages for invalid usernames or passwords leak information?
Are invalid passwords logged (which can leak sensitive pwd & user name combinations)?
Are the pwd requirements (lengths/complexity) appropriated?
Are invalid login attempts correctly handled with lockouts, and rate limit?
Does the "forgot pwd" routine leak information, vulnerable to spamming, or is the pwd send in plain text via email?
How and where are pwd and usernames stored, and are appropriate mechanisms such as hashing, salts, encryption in place?

Are the encryption algorithms used state-of-the art and compliant with standards such as FIPS-140?
Minimum key sizes to be supported
What types of data must be encrypted
Is sensitive data been secured in memory, storage and transit?
Do restricted areas require SSL?
Is sensitive information passed to/from non-SSL pages?