How to Get Started with Secure Code Review (and Actually Become Good at It)

I keep getting asked the same questions by developers and security engineers: