Investing In a Professional Code Review Firm

When developing your strategy for source code review and audit, the most fatal mistake you can make is to go it alone. At first thought, using in-house coders from your own development team might seem like a good way to cut cost, guarantee quality, leverage product familiarity, and speed the audit process along. Who is better equipped for the task, more knowledgeable of best coding practices, and more informed about functionality, maintainability, and security issues, than those in-house developers who live, breath, and work with your product’s source code, day in and day out? If that approach sounds like a good one … it’s not — and this article is for you.

Anyone with a personal or professional familiarity with the coding structure of a software product should be considered overly biased and unable to review the code in a detached manner that favors neither a positive nor a negative outcome. In-house developers tend toward “sunny day” scenarios, whereby they write code and test it to confirm in a way that verifies that it does what they want it to do. Often overlooked however, is that they don’t test the code to confirm to not do, what it should never do. A well-planned test environment will look for failure and success — good practice and bad — while remaining equally open to both.

It is in our nature to be biased toward one outcome or another when reviewing code in which we have any level of vested interest. Authors need an editor, sport teams need a referee, and source code reviews need trained source code auditors who are experienced in the art, science, and nuance of what to look for within the code and how to properly evaluate all findings, be those finding positive or negative to the outcome of evaluation.

In-house developers should of course perform code audits as a usual part of their end-to-end process. But they must also rely on an independent, well-trained review team to check over the final product before it is released into the world or considered for purchase. Developers who review their own code are biased toward their own way of writing code and will almost definitely miss key points or fail to recognize weaknesses within their design. Third-party reviewers such as Prolifogy, are paid to do impartial reviews and have no financial or emotional interest in arriving at any particular outcome.

Equally important is how the review is conducted. In most situations, not every line of source code can be inspected, which means code must be sampled. When reviewing lines of sample code, it is necessary to employ a methodology that supports well-informed extrapolations of data based on probability and best practices, understanding impact of frequency and type of findings, assignment of levels of severity, and a wide awareness of what to look for and what to recognize as a big red flag. And to an untrained eye, many big red flags will go unnoticed.

An average software developer acting as a code reviewer may not have any substantial experience with failed projects or may not be aware of the signs that a software project failure is imminent. Or, if they do find an issue, their experience in dealing with a failed project was likely limited to one particular role. Therefore, developers often do not fully understand what makes projects fail or what is at risk for the company when that failure occurs.

Professional reviewers such as those employed by Prolifogy, have hands-on experience dealing with the aftermath of software development issues that were not properly caught or addressed in earlier in-house stages of review and audit. At Prolifogy, we have our fingers on the pulse of what will most likely go wrong with a project, and we can gear our review and analysis toward focusing on those specific areas. Not only that, but since we are often involved in developing the fix, we are well-positioned to identify what’s wrong with the source code being examined and suggest how to fix any issues once they are adequately defined and better understood.

Professional reviewers focus on the complete picture, including areas that average software developers acting as a code reviewers are traditionally weak on: such as proper exception handling practices, security, and diagnosing slow performance. In many cases, the authors of source code are unaware that a problem even exists, and too often they are not in any position to undertake an effort to begin fixing that problem.

And in the case where a software project does fail and for any reason reaches litigation, our staff of professional reviewers provides qualified opinions to legal authorities by assisting the court and jury in understanding what went wrong and why. We bring this authoritative and expert-level courtroom insight into our everyday reviewing standards to help clients minimize the chance of ever ending up in court in the first place.