What Secure Development Should Look Like From the Outside

You can check this without being technical

Software security is presented as impenetrable, and the practices that prevent most real problems are describable in plain terms. A buyer can ask about them and judge the answers.

The five below are what we would want a client to ask us.

1. Is code reviewed before it ships?

Someone other than the author reads every change before it goes live. This catches mistakes, spreads knowledge and is the single most effective quality practice available.

For a solo developer, ask what substitutes for it — automated checks, a second pair of eyes on anything sensitive, or a periodic external review.

2. Are dependencies scanned and updated?

Modern software is built from hundreds of third-party components, and vulnerabilities are found in them constantly. Automated scanning plus a schedule for applying updates is standard practice.

Ask when dependencies were last updated. If the answer is “at launch” and launch was two years ago, that is the security finding right there.

3. Where do secrets live?

API keys, database passwords and tokens belong in a secrets manager or environment configuration, never in the code repository. Ask directly whether any credential has ever been committed, and what was done about it.

Also ask how they are rotated and who holds them. Shared production credentials known to everyone is fragile regardless of how trustworthy the team is.

4. Is authentication enforced on the server?

• Every request checked, not just the interface hiding a button
• Permission checked against the requesting user, on every record access
• Automated tests that attempt unauthorised access and expect failure
• Sessions expiring, and logout that actually invalidates

The classic vulnerability is a record identifier in a URL that returns someone else's data. Asking specifically about this is reasonable and revealing.

5. How quickly can you deploy a fix?

When a serious vulnerability is disclosed in something you depend on, the question is how fast a patched version reaches production. Teams with automated deployment answer in hours; teams with manual processes answer in days.

This is as much a resilience question as a security one, and the answer tells you about the whole delivery setup.

Frequently asked questions