Is there any information about how Bitcoin Core has applied secure development or application security in the past and currently? For example, the inclusion of third-party dependencies must be checked and tracked so that a dependency doesn't contain a vulnerability or an exploit, and the same reasoning about the build system.
Is there any policy and mechanism in practice for secure development and/or testing and verification of the security, including the dependencies and the build system?
I read somewhere that early development of Bitcoin Core was done in a "jail" but I couldn't find any other source than the mentioning of it in that specific article:
To address uncontrolled build inputs, it is tempting to “jail” builds into sanitized environments that always present a canonical interface to the underlying build system. Indeed, this was the approach taken by early projects such as Bitcoin and Tor (rbm.torproject.org). However, jails result in slower build times and impose technical and social restrictions on developers who may be accustomed to choosing their tooling. Most jails cannot address non-determinism issues either
Is there any more information about it? Was it a real BSD jail or just an isolated environment to make sure that only the allowed dependencies were included?