[rdl]

Presumably doing Matasano-type appsec work for DoD if it were for internal DoD software would be fine (i.e. making sure the VA's medical records system is relatively secure against outside threats)?

[tptacek]

We don't do work like that.