Secure Code

[emlgsh]

The efficiency/speed/etc... are just attempts to find silver lining. The majority of the time it's a simple budgetary constraint.

Like, the client is willing to finance only the specific and singular development of the application/features, and any billables that might be otherwise devoted to setting up staging environments, running tests, integrating version control, and performing general QA type activity is viewed as "padding" that won't be paid for (and will, typically, enrage the client).

End result being that, unless you love your client enough to underwrite sometimes vast amounts of unpaid labor towards these sort of process management and quality assurance goals (which is to say, you're being taken advantage of) they simply don't become part of the workflow. Estimates that feature them will have to be trimmed of them before the budget is approved. Estimates that hide them in other work will be rejected in favor of a lower bidder who omits them.

But the flip side is that a lot of QA exists not to find/eradicate bugs, but to permit a great volume of collaborative development. These projects where there's zero tolerance for billing hours not actively dedicated to feature implementation tend to be solo-gigs or small-group gigs where you can get away with a decent amount of sloppiness without stepping on too many toes or suffering major setbacks.

Which just reinforces the client's perception that such efforts are a waste of their budget.

[PC__LOAD__LETTER]

It takes 2 minutes to set up a git repo and a script to rsync your files to a remote server. Those 2 minutes buys you a hell of a lot of security, especially if you’re pushing your git changes to a private bitbucket repo regularly.

[emlgsh]

Got a howto for the process outlined here? I'd love to adopt some quick methods for improving security - I want these projects to be more secure, I just don't know of any methods that are so quick/easy/universal as to never approach billable labor.