What code review requirements exist in PCI DSS?

• A.Custom code must be reviewed by an approved scanning vendor within 30 days after release to production to confirm scan results show no flaws, with findings sent to the acquirer
• B.Bespoke software must be reviewed by the same developer who wrote it, who signs off in the ticket before release to production, with no second reviewer required
• C.Custom code that stores PAN must be reviewed once a year after release, with automated tools prohibited in favour of manual review
• D.Custom code must be reviewed prior to release to production to identify potential coding vulnerabilities, either through manual review or automated tools