Methods and systems for providing feedback and suggested programming methods

A software security assessment platform, comprising:

• a communications server, which in operation, receives technical characteristics of a target software application and business context information relating to the target software application;
• an analysis engine, which in operation:
• examines code of the target software application received and generates a model of the software application, the model containing control-flow and data-flow graphs of the software application;
• identifies specific application security best practices that are applicable to the target software application;
• identifies locations in the code of the target application, the locations being based on, at least in part, the control and data flow of the code contained in the model, and the locations indicating where code segments according to the identified best practices ought to be implemented, and
• determines for each of the locations whether the code segments according to the relevant best practices appear to have been implemented;
• determines at each of the locations whether the relevant best practices appear to have been implemented correctly and to what extent they have been implemented incompletely or incorrectly;
• and
• provides mixed positive and negative feedback to a developer for locations where it appears that the developer attempted to implement a certain best practice, and the implementation is correct, incomplete, or incorrect, excluding at least one location where a best practice is attempted but need not be implemented.