1. A software security assessment platform, comprising: a communications server, which in operation, receives technical characteristics of a target software application and business context information relating to the target software application; an analysis engine, which in operation: examines code of the target software application received and identifies specific application security best practices that are applicable to the target software application; identifies locations in the code of the target application where the identified best practices ought to be implemented and determines for each of the locations whether the relevant best practices appear to have been implemented; determines at each of the locations whether the relevant best practices appear to have been implemented correctly and to what extent they have been implemented incompletely or incorrectly; and provides positive feedback to developer of the target software application for what appears to be their correct implementation of the best practices.