That's nice. In reality, the security quality of a typical web application is quite low, especially compared to F500 enterprise standards --- few would survive a pentest. And yet most of them are not hacked in that manner.

Indie developers need to get better at writing software that is secure by default, but they do not need the whole process-driven juggernaut that Microsoft runs internally with things like SWI.

So, I asked because it sounded strange to me that a two-person news-recommendation startup would be spending serious time on security, as opposed to figuring out ways to make money on their property.