Security-minded Code Review

When reviewing documentation or code, I typically ask people to rate the level of pedantry they want me to provide in my commentary. This is mostly snarky, but it also covers a more legitimate set of questions based on the *goal* of the review. Is this merely a code quality edit? Are we trying to optimize the performance of some code? Do we need to assess the tone taken in documentation?