Codified Security
summary
Argues that shifting security left means giving developers secure primitives so they can write safe code without being security experts, and demonstrates it by building a PHP library that exposes parameterized queries, a safe file-read and a safe command-exec API, plus an audit script and recommendations for taint analysis, linting and semantic patching. The proof is live on the web and is exposed to attackers for a month with zero compromises, showing the approach largely works.
AI-written summary · about
chapters (15)
- 0:00Introduction and background
- 1:52Secure coding fundamentals
- 7:41Parameterized queries as gold standard
- 10:08Technical and process aspects of secure code
- 13:21Code generation and simplicity in security
- 15:14Anti-IF campaign and code complexity
- 18:47Shifting left in development process
- 21:58Taint analysis and variable context
- 29:05Writing secure PHP library
- 37:17File traversal vulnerabilities
- 44:48Command injection prevention
- 47:18Testing and validating secure code
- 49:05Process and auditing for security
- 51:56Semantic patching and future goals
- 53:45Conclusion and call to action
related talks
59mSecurity as Code: A DevSecOps Approach
25mSecurity First
48mSecuring Software’s Future
52mPractical Security in Web Applications
42mBeyond Code: Shaping Security in a Developer-Driven World
01h 01mSecurity: From basic principles to PHP specifics
01h 02mCode Review For Security
03mGreat software is secure software