Can I review code if I'm not a developer?
You can do the structural checks: does it build from a clean checkout, are there secrets in the repository, is there a list of endpoints with stated permissions, do tests exist and fail when something is broken. Those find real problems. The logic itself needs someone who can read it.
From How to review a codebase you didn't write, published 9 August 2026. That article is where the reasoning behind this answer is set out, including what it does not cover.