134 IBM Content Manager OnDemand Guide
6.2.1  Controlled environment
During development, all code is reviewed by two or more developers and passes through a 
structured process within the development organization to ensure the integrity of the code. 
The code is periodically scanned to ensure that no foreign code is included and to ensure that 
safe programming techniques are applied. The following practices are applied:
/SM590000Limited access: The source code is only accessible to the Content Management 
OnDemand team.
/SM590000Secure systems: The code is stored on secured systems behind the IBM firewall and can 
only be accessed by the Content Management Development team.
/SM590000Code reviews: All code modifications are reviewed by two or more developers on the team.
/SM590000Separation of duties: Separate development, build, and test teams exist.
/SM590000Redundancy: Two or more developers are familiar with each aspect (function and module) 
of the code.
6.2.2  Code scanning
The code is scanned three times, once at the beginning of the release or fix pack, once during 
the middle of the development process, and the last time at the end of the development 
process. Each time, three types of scans are performed:
/SM590000Code scan: This type of scanning searches for code that is external to the Content 
Manager OnDemand developed code. The goal is to ensure that no code is unknowingly 
inserted into the source code and to verify that all of the external code that is used is 
correctly licensed and will not result in any future legal action.
/SM590000Appscan source: This type of scanning searches for “bad code”. It verifies that all variables 
and pointers are correctly initialized, and that during the program operation, the values of 
variables and pointers can be changed only through the “correct” code path and cannot be 
altered by external sources. 
/SM590000Appscan Web: This penetration testing program is run against the common gateway 
interface (CGI) code to identify any potential security flaws.
6.2.3  Quality assurance testing
The quality assurance (QA) testing is run in parallel with the code development through the 
development cycle. When developers create new code, they perform their own unit test to 
ensure that the code works as intended. These unit tests are then passed to the QA team for 
automation. The QA team automates these tests and adds other newly automated tests to the 
regression bucket. 
Every time a new build occurs, which is nightly during peak development, automated 
regression and performance tests are run. These automated tests are run on the multiple 
operating systems that are supported by Content Manage OnDemand (Windows, Linux, AIX, 
IBM i, Linux on System z®, and z/OS). The goal is to detect any defects or performance 
impact so that it can be corrected the following day.
Periodically, endurance and stress tests are run to ensure that the code can run for long 
periods and under heavy workloads.
A specialized subset of these tests and cloud-specific tests are run against the Cloud release 
of Content Management OnDemand.