4 ms·
I'm not an expert in this field, but we recently did a security audit. The auditors get access to the code in order to evaluate it for vulnerabilities. In our r
by sb8244 10y ago
I'm not an expert in this field, but we recently did a security audit. The auditors get access to the code in order to evaluate it for vulnerabilities. In our ruby application, they also check gems that we are using (through open source tools albeit).
They also did an in-app audit where they tried to break the application however they might see that. Having access to the code helps with this.
When you get audited by potential customer, it usually involves not having code access and trying to penetrate the app without that access.
- BinaryIdiot 10y ago> When you get audited by potential customer, it usually involves not having code access and trying to penetrate the app without that access. Is this in reference to on-prem / enterprise software and is this typical? I haven't heard of customers doing this but it certainly makes sense (might as well invest thousands to test before spending magnitudes more on the product itself only to find it having a huge security hole). Then again I'm not sure I've worked with potential customers who have access to do something like that.
- softawre 10y agoWe just signed a big deal with a Google subsidiary, and part of that deal required us to go through a third party penetration test (no code access).
- BinaryIdiot 10y agoWell today I learned. Thanks!