Proper security is ensured by a validation process from a third party audit. That is expensive. For strictly internal scrutiny security is primarily the resul

Proper security is ensured by a validation process from a third party audit. That is expensive. For strictly internal scrutiny security is primarily the result of a proper risk analysis. Normally that means keep guessing until the software works enough and then refactor as necessary in response to some security apparatus far away from you. Same with accessibility, performance testing, and just about everything else beyond merely pushing content to screen.