I think it's good to both (a) talk to users and affected parties (e.g. users, node operators, wallets, miners, bitcoin startups, LN implementations, etc.) and (b) have extensive experience using the software, at least in the area you are reviewing. There is always the danger of finding oneself siloed in an ivory tower.