Yes, those are needed too. And static analysis and dynamic analysis, etc. Despite all of that we just found a SQL injection that existed for years somehow. L

Yes, those are needed too. And static analysis and dynamic analysis, etc. Despite all of that we just found a SQL injection that existed for years somehow. Luckily the WAF blocked attempts to exploit it until we could issue a fix. Defence in depth is the win here.