> Markdown version of [/playlists/secure-coding](https://www.wearedevelopers.com/playlists/secure-coding). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Playlist: Secure coding 16 videos · 18 moments · 88.5 minutes ## System Resilience: Surviving the Software Storm - **Applying secure coding practices and proactive system monitoring** (24:39, 2min) — Training developers to mitigate common application vulnerabilities and implementing continuous system scanning prevents minor disruptions from esca... [Learn more](https://www.wearedevelopers.com/videos/874-system-resilience-surviving-the-software-storm) ## Things You Don't Know About Cookies and How to Protect Them - Mohamed Shiralizadeh - **Securing cookie names and encrypting sensitive session values** (09:47, 2min) — Superficial encoding leaves data vulnerable, requiring robust encryption algorithms and secure name prefixes to protect sensitive session variables. [Learn more](https://www.wearedevelopers.com/videos/1859-things-you-don-t-know-about-cookies-and-how-to-protect-them-mohamed-shiralizadeh) ## Security Pitfalls for Software Engineers - **Writing secure code and utilizing threat modeling methodologies** (07:07, 3min) — Validating active user inputs and applying the STRIDE security framework proactively prevents deep operational system vulnerabilities. - **Securing exposed application programming interfaces against unauthenticated access** (15:11, 1min) — Enforcing strict authentication and transport layer encryption prevents malicious external actors from intercepting sensitive API endpoints. [Learn more](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) ## Securing Frontend Applications with Trusted Types - **Improving code security with trusted types in development environments** (20:55, 3min) — Catching and fixing improper DOM assignments during local development secures applications globally. [Learn more](https://www.wearedevelopers.com/videos/361-securing-frontend-applications-with-trusted-types) ## Going Beyond Passwords: The Future of User Authentication - **Implementing guidelines for strong and secure web passwords** (03:32, 1min) — Developers must enforce specific constraints like mixed capitalization, symbols, and length boundaries on login forms. [Learn more](https://www.wearedevelopers.com/videos/714-going-beyond-passwords-the-future-of-user-authentication) ## Always on the Right Track with Rails with Eileen Uchitelle, Senior System Engineer at GitHub - **Making security a foundational feature in software development** (04:20, 2min) — Using secure frameworks and educating teams early prevents vulnerabilities from becoming afterthoughts. [Learn more](https://www.wearedevelopers.com/videos/100358-always-on-the-right-track-with-rails-with-eileen-uchitelle-senior-system-engineer-at-github) ## Software Security 101: Secure Coding Basics - **Implementing strong cryptography, session management, and concurrency** (58:36, 16min) — Establishing non-guessable session identifiers and avoiding race conditions prevents severe logic exploits. - **Validating and encoding inputs to prevent injection attacks** (39:24, 19min) — Differentiating input validation from sanitization safely embeds untrusted data into target structures. [Learn more](https://www.wearedevelopers.com/videos/220-software-security-101-secure-coding-basics) ## Maturity assessment for technicians or how I learned to love OWASP SAMM - **Introduction to secure development and OWASP SAMM** (00:02, 5min) — Why focusing purely on secure coding is insufficient without a comprehensive secure development lifecycle. [Learn more](https://www.wearedevelopers.com/videos/351-maturity-assessment-for-technicians-or-how-i-learned-to-love-owasp-samm) ## Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks - **Mitigating vulnerabilities with automated scanning and secure practices** (24:08, 3min) — Implementing automated static application testing within local editor environments to continuously prevent directory traversal injections. [Learn more](https://www.wearedevelopers.com/videos/716-hack-proof-the-node-js-runtime-the-mechanics-and-defense-of-path-traversal-attacks) ## Organizational Change Through The Power Of Why - DevSecOps Enablement - **Contextualizing the why and how of security requirements** (09:20, 2min) — Providing real-world threat context and specific implementation guidance helps developers understand the value of secure coding. [Learn more](https://www.wearedevelopers.com/videos/478-organizational-change-through-the-power-of-why-devsecops-enablement) ## One Pipeline, Three Regulator - SBOM Compliance for the Developer - **Securing code provenance with digital identity signatures** (09:18, 2min) — Cryptographically tying developer identity to code commits secures code systems against spoofing and establishes verifiable provenance. [Learn more](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) ## Building Security Champions - **Teaching and coaching security concepts for lasting impact** (17:19, 10min) — Providing scoped training on secure coding, architecture, and tooling while delegating appropriate responsibilities effectively. [Learn more](https://www.wearedevelopers.com/videos/193-building-security-champions) ## Is Django too Complicated? - **Security defaults and preventing cross site request forgery** (11:46, 3min) — Explicit security configuration settings and protective framework environments inherently defend novice software developers against severe web vuln... [Learn more](https://www.wearedevelopers.com/videos/112-is-django-too-complicated) ## Dangerous Reactivity: Why AI Output Is the New XSS - **Securing frontend applications against untrusted user inputs** (00:03, 1min) — Treating applications as fortresses helps developers protect digital identities and block malicious entry points. [Learn more](https://www.wearedevelopers.com/videos/100115-dangerous-reactivity-why-ai-output-is-the-new-xss) ## Bulletproof Web Applications: The 2025 OWASP Top Ten - **Securing token signatures and preventing authentication failures** (19:33, 1min) — Avoiding critical authentication flaws by using strong cryptographic secrets and secure session management patterns. [Learn more](https://www.wearedevelopers.com/videos/100072-bulletproof-web-applications-the-2025-owasp-top-ten) ## 101 Typical Security Pitfalls - **Core principles for input validation and memory safety** (24:40, 2min) — Strict input sanitization, careful data type casting, and proactive memory management form the foundation of secure software. [Learn more](https://www.wearedevelopers.com/videos/414-101-typical-security-pitfalls)