I added a agentic QA (exploratory testing) at the end, after the reviews, with patterns about how to break the system
(it can works with web-based application, as well as APIs, CLIs, and even mobile apps inside an emulatore)
This agentic QA discovers defects that the "static" code reviews miss.