Yes. We have a formal security process, which includes threat modeling, secure programming and core reviews. We also use metrics to evaluate performance.