WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • May 10, 2024

Typed Security: Preventing Vulnerabilities By Design

Michael Koppmann

Stop relying on endless runtime validation to secure your core. Discover how strong typing can make entire classes of software vulnerabilities structurally impossible to compile.

Pause
Mute Enter Fullscreen
#1 about 2 min

Preventing software vulnerabilities with strong type systems

Enforcing structural constraints in application design practically eliminates entire categories of vulnerabilities.

#2 about 2 min

Structuring applications using domain-driven design concepts

Structuring business logic with entities, aggregates, and bound contexts separates technical implementations from core operations.

#3 about 5 min

Encoding business rules into programming data types

Making illegal states representable catches invalid data configurations at compile time without requiring explicit runtime checks.

#4 about 4 min

Handling missing values safely using optional types

Avoiding implicit null values by wrapping variables in optional classes forces callers to handle failure cases explicitly.

#5 about 2 min

Protecting data constraints by eliminating primitive obsession

Wrapping basic structures into specialized value objects prevents invalid manipulations and accidental argument swaps.

#6 about 9 min

Building robust domain models using smart constructors

Restricting public constructors and leveraging pattern matching ensures that critical states like verified emails are explicitly proven.

#7 about 10 min

Preventing broken access control with strict types

Passing statically verified access tokens instead of relying on boolean checks ensures authorization logic cannot be bypassed.

#8 about 3 min

Eliminating database injection flaws through query types

Rejecting raw string execution in favor of dedicated query wrappers neutralizes accidental concatenation vulnerabilities.

#9 about 4 min

Isolating sensitive domain models via data transfer objects

Exchanging structured payloads rather than internal domain entities prevents over-posting and accidental secret data exposure.

#10 about 2 min

Stopping cross-site scripting attacks via secure HTML types

Using frameworks that enforce specific display types forces automatic encoding and sandboxing of untrusted user input.

#11 about 2 min

Applying pure core architectural patterns to web applications

Keeping raw domain logic centralized within hexagonal patterns protects business layers from external network impurities.

#12 about 3 min

Key resources and takeaways for incorporating typed security

Embracing rich domain modeling turns security requirements into verifiable static proofs during compilation.

#13 about 17 min

Exploring practical challenges of strict type systems

Evaluating validation boundaries and migration strategies clarifies how organizations can adopt strict type systems effectively.

Matching moments

1:52 min

Rethinking application design and standard code type safety practices

Liran Tal Liran Tal · WWC 2025

4:34 min

Discovering the hidden drawbacks of advanced type mitigations

Stefan Baumgartner · WWC 2023

2:31 min

Addressing insecure design through early threat modeling

Christian Wenz Christian Wenz · WWC Europe 2026

3:19 min

Writing secure code and utilizing threat modeling methodologies

Jasmin Azemović Jasmin Azemović · WWC 2023

3:59 min

Improving code security with trusted types in development environments

Philippe De Ryck · LIVE

1:20 min

Core takeaways for end-to-end TypeScript development

Marco Podien Marco Podien · WWC 2025

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
5 days ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
5 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail
1:10:26
12 days ago

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail
1:02:34
19 days ago

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail
1:07:59
26 days ago

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail
5:55
about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans
Open session

World Congress 2026 North America

Designing APIs That Survive AI Agents at Scale

Phani Pendurthi

Mastercard, Principal Software Engineer

Phani Pendurthi
Open session

World Congress 2026 North America

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy

Related videos

Software Security 101: Secure Coding Basics thumbnail
1:58:48
WWC 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

Friend or Foe? TypeScript Security Fallacies thumbnail
27:41
WWC 2025 • 12 months ago

Friend or Foe? TypeScript Security Fallacies

Liran Tal

Don't compromise on speedy delivery nor type-safety by choosing TypeScript thumbnail
29:44
WWC 2023 • almost 3 years ago

Don't compromise on speedy delivery nor type-safety by choosing TypeScript

Jens Claes

101 Typical Security Pitfalls thumbnail
28:41
WWC 2022 • about 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

End-to-End TypeScript: Completing the Modern Development Stack thumbnail
29:17
WWC 2025 • 12 months ago

End-to-End TypeScript: Completing the Modern Development Stack

Marco Podien

Lies we Tell Ourselves As Developers thumbnail
31:13
WWC 2023 • almost 3 years ago

Lies we Tell Ourselves As Developers

Stefan Baumgartner

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.