2026-11-04 –, Lightning Stage
Freeze-commit security reviews assume development can pause while the review takes place. This talk explains why that assumption breaks for fast-moving, production-critical code and presents a rolling alternative that preserves a concrete final review target while moving security work into the development loop.
A frozen commit gives security reviewers a stable target and makes every review hour count. But when a team ships production-critical changes every two weeks, a multi-week sequential review forces a choice: slow development, accept growing scope drift, or let security fall behind.
Drawing on experience reviewing code on short release cycles, this talk separates the certification of a freeze-commit review from the workflow built around it. It introduces a rolling pattern: establish a reviewed baseline, assess scoped pull requests as they land, then perform an integration review against one final commit. The final commit remains the subject of the audit opinion.
This is not a free speedup. Code may be reviewed more than once, coordination rises, and reviewers must track scope continuously. Attendees will leave with a simple framework for deciding when reduced wall-clock delay justifies that extra reviewer effort.
Blog - https://sigmaprime.io/blog/collapsing-security-review-cycle/
Kirk Baird is a Director at Sigma Prime, a blockchain security and research firm. Over more than eight years in the industry, he has progressed from security engineer and auditor to leading Sigma Prime’s security services, operations and R&D. Kirk has reviewed blockchain implementations across Ethereum, Solana, NEAR, Cosmos and Filecoin, working extensively with Solidity, Rust and Go.