And ultimately the biggest thing to do is that when you find a bug, don't just fix that one bug and call it a day. If you find a bug in your crypto code throug

And ultimately the biggest thing to do is that when you find a bug, don't just fix that one bug and call it a day. If you find a bug in your crypto code through your testing and validation, that means your development process screwed up and allowed that bug to slip through. What you need to do is figure out how that bug got through your development process, change your development process so it wouldn't slip through next time, and then have a thorough audit of your already-written code to make sure no other bugs have slipped through the same way. Developing must-not-fail critical software is the exact opposite of the traditional launch-fast-and-iterate model that most people use to produce web applications and such. This is a big reason that when web app developers try their hand at developing critical software like cryptography, they get it horribly wrong.