> My constructive advice, then, is that you engage with your security professional before starting work, ask them for their input, and follow it. You sound exa

> My constructive advice, then, is that you engage with your security professional before starting work, ask them for their input, and follow it. You sound exactly like the kind of security professional I’d like to work with and I agree with everything you said. To give you an idea of my lived experience, I’ve actually had security team members refuse to disclose the tools they are using. This baffled me, because as you say why wouldn’t they want developers to run linters as part of their process? The only possible explanation I can think of is that being a human frontend for automated tooling is an easy high paying job.