OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help explain if it would make sense to perform secure coding before QA and UAT testing. Questions below:
Wouldn't it waste resources to perform secure code after testing? If remediations are required post secure code review, then the code will require to be QA and UAT tested again to ensure business requirements are met.
Can real-time code secure code review in Visual Studio and Team Foundation Server (TFS) address secure code review requirement or does the codes require to be compiled again and scanned to ensure all vulnerabilities are addressed?