We hired a security engineer and got back 123 findings

"The thing I did not anticipate is how much of the value was in the second-order lessons. Nobody files an advisory titled “your REVOKE statements are decorative.” You only learn that by doing the remediation with a paranoid person looking over your shoulder, and then checking the catalogs instead of believing the migration output."

Is such a good and grown up summary. Kudos for writing this up.

We are taking turns in small teams being on duty for only finding and fixing bugs for two weeks. They are working on features with a much sharpened eye after and don't repeat bad habits so easily. Having drilled down to the core gives you the necessary understanding.