Using "Security Review" gives file permission errors, how to fix them?
If your webserver user is the same as your account user that you use to login and update the files, then the files should be 440 and folders 550. However, this will make it hard to edit or update the code of the site as you will have to change the permissions back to 755/644 before doing the update.

Note, also, that using anything other than 0 as the final digit in the three is likely the wrong value on a shared server where you do not know/trust every user of the server.

The security review test is about "defense in depth" that prevents a poorly coded file-upload tool from becoming a way to overwrite executable files in Drupal's installation. Sometimes it's OK to ignore some of the reviews from security_review module.