mediumConceptDesignMidSeniorStaff
Would you rather build a framework that is secure by default, or train developers to write secure code? Why?
Secure-by-default framework design wins because it removes the vulnerability class from the option space entirely, while training relies on every developer remembering every rule on every request; the two are not actually substitutes, since training is still needed for what the framework cannot enforce.
3 min readUpdated 2026-08-15
Answer
Short answer
Secure-by-default framework design usually beats relying only on developer discipline because it removes common vulnerability classes from the easiest path. Training still matters for business logic, authorization, and novel risks, but defaults scale better for repeated mistakes like injection, unsafe output, and weak crypto choices.
Was this answer helpful?
Likely follow-ups
- Give a concrete example of an API design that makes the unsafe path harder to reach than the safe one.
- What happens to a secure-by-default framework when a team routes around the default because it is inconvenient?
- How would you retrofit secure defaults into an existing codebase that was not built with them?
- What kind of vulnerability is a framework default structurally unable to prevent?
Related questions
- Your vulnerability scanner just reported four thousand findings across the codebase. How do you actually triage that?mediumAlso on appsec and secure-coding3 min
- What is the difference between SAST, DAST and SCA, and what kind of vulnerability does each one miss?mediumAlso on appsec and secure-coding4 min
- You are told there is a memory-safety bug somewhere in a large C or C++ codebase, and you cannot read all of it. How do you narrow the search?hardAlso on appsec5 min
- Walk me through applying STRIDE to the boundary where our order service calls the payments service over the network.mediumAlso on appsec4 min