Does anyone have any experience with outsourcing security code review via freelance sites (like Rent-a-coder, Elance, Guru, Getafreelancer, etc.)? Is this effective? What are the best practices? Are there any pitfalls? Does anyone have any recommendations or lessons-learned? Are there any resources or readings to learn more about others experience with this?
Some example questions: Do you have any advice for how to screen for freelancers with security knowledge? (Is there a standard pre-test to screen candidate freelancers?) For security review, is it more effective to ask for open-ended review, or is it more effective to create many smaller tasks with a narrow scope (e.g., review this codebase for SQL injection vulnerabilities)? Pricing-wise, are there any standard rates or pay ranges? Is it more effective to charge a fixed price, or are bonuses effective (e.g., a bonus for finding a vulnerability)? Is it a good use of money to try to hire multiple people for the same code review task, to maximize the chances of finding problems, and/or to cross-compare their results and identify the most effective freelancers?
One issue you can take as out of scope: you can assume that I understand the risks of sharing such code with unknown individuals, and am comfortable with that.