the cheapest place to catch an attack is the document
The design document for the identity layer was audited more times than the code that came out of it. Each round was independent, each produced findings sorted into severity bands, and each finding had to be resolved in place: a new…