Agreed that post-hoc security cannot work very well. Hope it becomes more and more obvious industry-wide. One thing I do to practice "continuous security", is

Agreed that post-hoc security cannot work very well. Hope it becomes more and more obvious industry-wide. One thing I do to practice "continuous security", is to accompany each code review with an additional code review, solely focused on security. Else it's too many balls to juggle when doing a general-purpose code review. Do you know of similar simple yet effective techniques?