Story

"... expected standards for secure code. This includes issues such as lack of comments ..."

I've worked in some security-related areas, and I hate 99% of comments. Make the code intrinsically readable and obvious. If you have to explain your code, then it's not written clearly enough. And heaven forfend that the comment says something nice and reassuring, yet the code itself actually has a flaw - that comment would be worse than useless, it's downright dangerous.