> Markdown version of [/events/world-congress-2025/sessions/694-friend-or-foe](https://www.wearedevelopers.com/events/world-congress-2025/sessions/694-friend-or-foe). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Friend or Foe? TypeScript Security Fallacies


- **Date:** Thursday, Jul 10, 2025
- **Time:** 17:30–18:00 (30 min)
- **Room:** Stage 1
- **Event:** World Congress 2025
- **Tags:** cybersecurity, design patterns, typescript

## Recording

[Watch recording](https://www.wearedevelopers.com/videos/1424-friend-or-foe-typescript-security-fallacies)

## Description

So TypeScript has become the de facto industry standard for developing web applications these days and promising type security, but do developers properly understand the role it plays in securing applications and does the type safety promise hold true in face of real-world security threats?

Developers often mistake dev-time vs runtime security as well as confuse test cases for security guard rails. Can TypeScript actually provide you with code security benefits? In this session we will explore insecure TypeScript patterns, learn how HTTP parameter pollution vulnerabilities impact TypeScript code bases and witness first-hand how attackers employ prototype pollution attacks that cripple codebases even when developers use schema validation libraries like Zod. Through hands-on coding we’ll hack a TypeScript application and learn security best practices.

## Speaker

### [Liran Tal](https://www.wearedevelopers.com/@liran-tal)

GitHub Star | Director of Developer Advocacy at Snyk


## Related talks at this congress

- [Code Red: When Your Tools Turn Against You ](https://www.wearedevelopers.com/events/world-congress-2025/sessions/510-code-red-when-your) — Aaron Bray, Julian Totzek-Hallhuber
- [End-to-End TypeScript: Completing the Modern Development Stack](https://www.wearedevelopers.com/events/world-congress-2025/sessions/759-end-to-end) — Marco Podien
- [Real-World Security for Busy Developers](https://www.wearedevelopers.com/events/world-congress-2025/sessions/860-real-world-security) — Kevin Lewis
- [Best of the Worst – the most awful anti-features in JavaScript, ranked!](https://www.wearedevelopers.com/events/world-congress-2025/sessions/630-best-of-the-worst) — Peter Kröner