> Markdown version of [/videos/892-typed-security-preventing-vulnerabilities-by-design?t=83](https://www.wearedevelopers.com/videos/892-typed-security-preventing-vulnerabilities-by-design?t=83). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Typed Security: Preventing Vulnerabilities By Design

Stop relying on endless runtime validation to secure your core. Discover how strong typing can make entire classes of software vulnerabilities structurally impossible to compile.

- **Speakers:** Michael Koppmann
- **Event:** WeAreDevelopers LIVE
- **Published:** May 10, 2024
- **Duration:** 58:19
- **URL:** https://www.wearedevelopers.com/videos/892-typed-security-preventing-vulnerabilities-by-design

## Summary

By integrating strong type systems with Domain-Driven Design (DDD) principles, developers can structurally eliminate entire classes of software bugs and security flaws at compile time. The common pitfall of "primitive obsession"—using basic data types like strings for everything from UUIDs to database interactions—leaves applications vulnerable to improper state changes and injection attacks. By designing custom value types and leveraging smart constructors, teams can implement the philosophy to "make illegal state representable," ensuring that invalid data combinations cannot even be compiled.

Transforming simple runtime assertions into static compiler proofs drastically minimizes the need for boilerplate validation and unit tests. Techniques like using optional wrappers organically abolish the billion-dollar mistake of null pointer exceptions, while sum types and pattern matching robustly encode complex business rules. Furthermore, the "parse, don't validate" methodology ensures that raw inputs are instantly transformed into verified, immutable types upon entry. This explicitly protects the application's clean inner core from external tampering, aligning seamlessly with hexagonal or onion software architectures.

Strategic utilization of data transfer objects (DTOs) mitigates broken object-level access control and unintended data exposure by strictly filtering what is allowed across domain boundaries. Additionally, strong types can act as unforgeable access tokens for authorization flows; by restricting constructor exposure, only authenticated code pathways can generate a valid permissions token. Architecting solutions where SQL queries are strict query types rather than concatenable strings, or HTML output is intrinsically typed, effortlessly blocks injection and cross-site scripting vulnerabilities—proving that optimal software security is achieved when safety is the unbypassable default state of the compiler.

**Keywords:** domain-driven design principles, primitive obsession anti-pattern, smart constructor pattern, sum types and pattern matching, compile-time vulnerability prevention, null pointer exception avoidance, data transfer objects mapping, sql injection mitigation, cross-site scripting defense, broken access control protection, hexagonal architecture patterns, parse don't validate philosophy, phantom types implementation, immutable value objects, type-driven development

## Chapters

1. **Preventing software vulnerabilities with strong type systems** (00:12) — Enforcing structural constraints in application design practically eliminates entire categories of vulnerabilities.
1. **Structuring applications using domain-driven design concepts** (01:23) — Structuring business logic with entities, aggregates, and bound contexts separates technical implementations from core operations.
1. **Encoding business rules into programming data types** (03:21) — Making illegal states representable catches invalid data configurations at compile time without requiring explicit runtime checks.
1. **Handling missing values safely using optional types** (07:28) — Avoiding implicit null values by wrapping variables in optional classes forces callers to handle failure cases explicitly.
1. **Protecting data constraints by eliminating primitive obsession** (10:52) — Wrapping basic structures into specialized value objects prevents invalid manipulations and accidental argument swaps.
1. **Building robust domain models using smart constructors** (12:23) — Restricting public constructors and leveraging pattern matching ensures that critical states like verified emails are explicitly proven.
1. **Preventing broken access control with strict types** (21:01) — Passing statically verified access tokens instead of relying on boolean checks ensures authorization logic cannot be bypassed.
1. **Eliminating database injection flaws through query types** (30:03) — Rejecting raw string execution in favor of dedicated query wrappers neutralizes accidental concatenation vulnerabilities.
1. **Isolating sensitive domain models via data transfer objects** (32:13) — Exchanging structured payloads rather than internal domain entities prevents over-posting and accidental secret data exposure.
1. **Stopping cross-site scripting attacks via secure HTML types** (36:02) — Using frameworks that enforce specific display types forces automatic encoding and sandboxing of untrusted user input.
1. **Applying pure core architectural patterns to web applications** (37:46) — Keeping raw domain logic centralized within hexagonal patterns protects business layers from external network impurities.
1. **Key resources and takeaways for incorporating typed security** (39:15) — Embracing rich domain modeling turns security requirements into verifiable static proofs during compilation.
1. **Exploring practical challenges of strict type systems** (41:45) — Evaluating validation boundaries and migration strategies clarifies how organizations can adopt strict type systems effectively.

## Related Moments

- [Rethinking application design and standard code type safety practices](https://www.wearedevelopers.com/videos/1424-friend-or-foe-typescript-security-fallacies) (from "Friend or Foe? TypeScript Security Fallacies")
- [Discovering the hidden drawbacks of advanced type mitigations](https://www.wearedevelopers.com/videos/610-lies-we-tell-ourselves-as-developers) (from "Lies we Tell Ourselves As Developers")
- [Addressing insecure design through early threat modeling](https://www.wearedevelopers.com/videos/100072-bulletproof-web-applications-the-2025-owasp-top-ten) (from "Bulletproof Web Applications: The 2025 OWASP Top Ten")
- [Writing secure code and utilizing threat modeling methodologies](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) (from "Security Pitfalls for Software Engineers")
- [Improving code security with trusted types in development environments](https://www.wearedevelopers.com/videos/361-securing-frontend-applications-with-trusted-types) (from "Securing Frontend Applications with Trusted Types")
- [Core takeaways for end-to-end TypeScript development](https://www.wearedevelopers.com/videos/1580-end-to-end-typescript-completing-the-modern-development-stack) (from "End-to-End TypeScript: Completing the Modern Development Stack")

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [How to Avoid Over-Engineering](https://www.wearedevelopers.com/magazine/546-how-to-avoid-over-engineering)
- [Security Basics for Vibe Coders](https://www.wearedevelopers.com/magazine/598-security-basics-for-vibe-coders)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)

## Related Jobs

- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Principal Software Engineer, Database Infrastructure](https://www.wearedevelopers.com/jobs/ext/1465908-principal-software-engineer-database-infrastructure) at **GitHub**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**