Are security vulnerabilities an indicator of development testing practices?

Mon, 10 Mar 2025 18:34:57 +1100

TLDR: Security vulnerabilities might be an indicator of low automated unit, integration and regression testing capabilities. Finding vulnerabilities is easier than fixing them as bug fixes need to be tested. Identifying libraries that are getting behind in versions is one indicator of code repository health.

When I first meet a development team, I like to ask three questions to gain an understanding of where they are at:

How often do you release? (e.g. daily, weekly, monthly, quarterly, on demand or adhoc)
How often can you release? (e.g. they can release quickly but don’t)
How much manual testing is required per release?

While answers can be subjective, when there is a higher manual testing and a longer release cycle it more likely it’s going to be harder (or more intensive) to test security fixes and their impacts.

What are orphaned repos and why should you care

Mon, 10 Mar 2025 17:50:26 +1100

TLDR: If no one knows the code, how will you fix or redeploy it? Knowledge of code is important to maintain, operate and make bug or security fixes. However, removing unused repos might improve focus by removing clutter.

In the book, The Mythical Man-Month by Fred Brooks, it talks about disproportionate amount of time developers spend thinking compared to coding. Some say that that source code is only 30% of the development process, with thinking, discussions and discovery being the other 70%. So even if we’ve got the code, we’re missing the thinking which is still in the developers head. Even documentation might not do justice to that days or weeks of thinking and discussions which occurred.

Articles on Kospex - Git Analytics

Are security vulnerabilities an indicator of development testing practices?

What are orphaned repos and why should you care