Cost to fix bugs pre-production

["Mark Curphey" <mark () curphey com>]

A while back I read a research paper that compared some figures for the
financial cost of fixing an application security bug when it is in
development, pre-production and then finally in production. I have lost the
link. Does anyone know of any such papers ?

Has anyone ever seen a study of the cost of fixing a problem occurring from
code review against the cost of fixing an issue that got into production and
had to be retrofitted ?