Topics / Engineering practice
Correctness and security audits ask overlapping questions.
Security examines threats and protections. Correctness examines whether intended behavior holds. A serious change can require evidence from both.
Separate the questions, then connect them.
| Example | Correctness question | Security question |
|---|---|---|
| Refund processing | Does the amount and currency match the approved refund? | Can an unauthorized actor initiate or alter it? |
| File import | Are valid rows retained exactly once? | Can crafted input escape a boundary or exhaust resources? |
| Tenant query | Does the query return the requested records? | Can it return another tenant’s records? |
The boundary is not clean in every case. An authorization rule is also a behavioral requirement. Use the distinction to identify missing work, not to argue that one discipline replaces the other.
Match the evidence to the claim.
Illustrative example
A clean dependency scan, a broken refund.
All known dependency checks pass, but the application refunds in the account’s default currency instead of the transaction currency. That business rule needs its own expected outcome and executed scenario. Conversely, a correct refund amount does not establish resistance to an authorization attack.
Start with consequential promises and credible misuse. Link findings to the requirement or protection they challenge. Track whether the outcome is reproduced, fixed, accepted as risk or still unknown.
Bring both into one change record.
Proof can retain requirements, hazards and verification evidence together. External analyzer results can contribute to that record. Their presence does not make every allegation true or establish that all relevant attacks were tested.
Keep specialist security testing where it is needed. The practical benefit is less reconstruction between the security reviewer, domain expert and engineer implementing the fix.
Try it on your software
Choose a component where security and behavior meet.
Payments, authorization and data handling often provide a useful first scope.