To deciding which frameworks, languages, technologies, standard… should be used and then to established patterns of application architecture and software development

This typically includes a code review process that helps ensure the project has met the required features and functions, as well as various testing that identifies weaknesses in custom code, known open source vulnerabilities.

To allowing for a more in-depth analysis of the security of the application. Depending on the size of the feature and the resources available, this is also a good place to implement manual security testing