Secure Coding Practices

Because developers don't always consider the security aspect. Not saying this is what he's doing but could also just be due to how complex good software can be to write.Their is a reason cybersecurity or UI/UX or product design isn't always left to the developer. The coder write code that fits certain criteria they are given, then someone down the line might QA check it, fuzz inputs or security review the code. How well this is done depends on the product,market, and envir

I've seen lots of "experts" write really insecure code. While it is certainly possible someone did this maliciously. Devs often don't understand the code they write and repeat until they get something that "works" and call it good. With an app that touts security I would hope for better.

Nope, you've got it backwards :) If you really want security, it's something that no programmer should have to think about. Your language/framework/platform/API has to provide it for free. Trying to make every developer a security expert is a laughable proposition. That's my conclusion after 15 years in the security industry.

This is fun and all, but if the message that this tries to pass along is "don't bother with proper security because it's very hard/impossible, do your best and ship, you can always fix your code", than that's bullshit. Secure coding is possible and is our responsability when we are writing code that others are meant to use somehow, and if most of the devs lack the formation in secure coding and if many companies don't ensure the code is secure to some standard

Nothing fair about making software insecure. Don't normalise it.

"Never write your own security code, because you'll get it wrong. Leave it to the smart people."

Yes, everybody always assumes that the code is secure. That's the root cause of the problem.

That's an unreasonable expectation. Security is not left to bug fixes. It is a skill developed by overall knowledge of the domain, and an explicit intent to be conscious of how what you write can be misused.If someone can scan your repo for a problem this quickly, then youre not designing secure software, and that should be posted front and center at the top of the repo given that wasms entire purpose is machine independent code that is properly sandboxed from exploitation.

For non copilot, the words around the code found on stack overflow or a blog post may indicate the lack of correct security, which would be a signal to a developer that they need to consider something further.

Most developers don't know securityhttp://www.akashasec.com/most-developers-dont-know-security/