How to prepare for a security review

Summary: Trail of Bits outlines four preparation steps for a security review: define the questions you want answered, resolve easy issues and clean the codebase before handoff, document incomplete changes and past security reviews and bugs, and deliver the code with clear build and deployment guidance. The post compares the assessment team to newly hired, fully remote developers who are skilled but unfamiliar with your product and codebase.
What's compelling: The post states that skipping this preparation means wasting money, losing time, and missing security issues, and that undocumented incomplete changes can cost consultants a week digging into code that will be gone in two months.

Read the original at Trail of Bits Blog ↗