Security is not a role — it's a responsibility shared by every developer who writes code that touches user data. The majority of security breaches are not sophisticated zero-day exploits. They are basic, well-documented vulnerabilities that have existed for decades: SQL injection, broken authentication, insecure dependencies, and misconfigured cloud resources. The OWASP Top 10 has listed most of these same categories for 20 years. They persist because security is treated as someone else's problem until it isn't.
The Non-Negotiable Fundamentals
- SQL Injection: Use parameterised queries or a trusted ORM. Never concatenate user input into SQL strings. Ever. This vulnerability is 30 years old and still appears in production code weekly.
- Password storage: bcrypt, scrypt, or Argon2. Never MD5 or SHA-1. Never plain text. The hash algorithm must be slow by design — that's the point.
- Authentication tokens: Short expiry (15–60 minutes), signed with a strong secret stored in environment variables, validated on every request. Never stored in localStorage — use httpOnly cookies.
- Input validation: Validate type, format, length, and range on both client and server. The client validation is for UX; the server validation is for security. Never rely on the former for the latter.
Dependency Security
Modern applications depend on hundreds of open-source packages. Any one of them can introduce a critical vulnerability. Run npm audit (or pip-audit, cargo audit) in your CI pipeline and fail the build on high-severity findings. Enable Dependabot or Renovate to automatically open PRs for dependency updates. Subscribe to security advisories for your core dependencies — you want to know about a critical vulnerability in Express or Django before your users do.
Secrets Management
Secrets in code are the single most common source of data breaches. Run git secrets or gitleaks as a pre-commit hook to block API keys, connection strings, and passwords from ever entering your repository. Use environment variables for all secrets, manage them via a secrets manager (AWS Secrets Manager, HashiCorp Vault, Doppler) in production, and rotate them on a schedule — ideally automatically. A secret that has never been rotated is a secret that might have been compromised months ago without your knowledge.