The guide seems to have reasonable technical measures. I would like to see more discussion of risk, both in terms of what is being protected, and of who might

The guide seems to have reasonable technical measures. I would like to see more discussion of risk, both in terms of what is being protected, and of who might be trying to attack. For example, you might wish to be more careful when developing a bitcoin wallet than when tracking baseball scores. Shameless plug: I've been working on a somewhat less practical guide to software development security practices [1]. Even more shameless plug: I'm currently running a survey of security practice use in software development [2], and would welcome participants who work on open source projects. [1] http://pjmorris.github.io/Security-Practices-Evaluation-Framework http://pjmorris.github.io/Security-Practices-Evaluation-Fram... [2] https://ncsu.qualtrics.com//SE/?SID=SV_1HdQOa2lfX57vkF https://ncsu.qualtrics.com//SE/?SID=SV_1HdQOa2lfX57vkF