Field notes
Scoping a pre-release assessment when the calendar will not move
— How to choose launch-critical paths so a short assessment still changes the go/no-go call.
A pre-release security assessment is not a miniature version of a full secure code review. It is a deliberate narrowing: name the paths that can stop the launch, ignore the rest for this window, and write residual risk in plain language.
Choosing paths
Good candidates: authentication, payment capture, partner callbacks, admin privilege changes, and bulk data export. Poor candidates: every microservice “just in case,” marketing pages, and unfinished features behind flags you will not enable.
What we refuse
We refuse to promise “full coverage” in three days. If a stakeholder needs that sentence, they need a longer engagement or a postponed launch. Naming the limit early protects both the report and the relationship.
After the memo
Blockers get fixed or features get cut. Advisories enter the backlog with owners. Utility Brook can continue into a fuller review once the release pressure eases — same access, wider surfaces.