How security developments are done in eOS

[wasantosfi]

Just a sincere question about security topics in eOS' CI/CD cycle.
I know the resources are very limited if compared to Canonical or Red Hat.
For example:
-- If tools like SonarQube, GitHub Advanced Security, Snyk, and others are integrated to development processes.
-- If there is periodic security training to developers, etc.

[RMcNeely]

As far as I am aware there are no static analysis tools for Vala language (what the vast majority of elementary apps are written in) so there is no support for things like SonarQube etc.

I am not currently familiar with processes for desktop app development but I can say that for most of the web apps they are not hooked up to similar tools. Dependabot runs for npm updates.