Is there a way to rate or review the security for a Java web application? Except for web scanner or code audit, does it exist a metric/procedure to evaluate the application's security?
Also I have read How to rate Open Source Libraries? and Are there any web application security standards?, but they don't solve my question. I need a metric to rate the code, then can refactor the application's Java code in order to reduce its security weaknesses.