The code should actually work.

Check for:

• Logic errors: Off-by-one, null checks, boundary conditions
• Edge cases: Empty inputs, large data, concurrent access
• Error handling: Failures handled gracefully?
• Security: Input validation, SQL injection, XSS

Think like a tester. What inputs would break this?