stellersjay

Hey HN,

I've crafted a really quick/small "Startup Security Due Diligence Survey" primarily aimed at startups from seed to Series C stages. The intention is to gauge how startups perceive and handle security matters during their early and mid phases.

However, if you're outside this range, either pre-seed or post-Series C, your insights would still be valuable. We believe that gathering a broader perspective can provide more comprehensive results and potential benchmarks for the community. All responses are anonymous, with an optional field for your name and email at the end in case you want to see full results

If you have a few minutes to spare (really short), I'd appreciate your feedback on the survey. https://forms.gle/oiVxqifijpA74sMV6

Thanks for your time and insights!

Curious on how most developers/engineers receive reported security issues in their code, service or infrastructure today? What you do and dont like about the process? What would be ideal view of seeing such submissions?

For security teams what are some pain points of being able to submit security related bugs to developers. What would be your ideal way to communicate to developers?

For those of you who deal with finding security defects/flaws within companies/organizations and for those of you that deal with patching/remediating those defects,

What are some of the common issues you wished were solved to help address the sheer overload of information on these defects?

Some problem spaced examples can included: Static application security testing (SAST), Dynamic application security testing (DAST), Vulnerability scanning, supply chain, CIS/NIST/CSF benchmarking, etc