Incoherent Code: How Code Quality Impacts Security
summary
Claim: low code quality raises measurable security risk by hiding missing input sanitization, tangled SQL and absent schemas that break audits. Evidence includes a real PR with ~120 review comments and examples where a clean MVC endpoint with reusable middleware for input sanitization and schema-driven inputs/outputs prevents repeat mistakes. Recommended practices: add type checks to CI, enforce encapsulation and separation of concerns, improve observability for audits. Cisco experience is cited as context.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 4:22Code quality and security
- 10:08Code quality as communication
- 21:26Cognitive load and understanding
- 33:51Mentorship in code
- 43:10Systems thinking and security
- 46:44Security best practices
- 53:23Diagnosing problems
- 57:42Summary
related talks
37mSecurity as Code: A DevSecOps Approach
59mSecurity as Code: A DevSecOps Approach
33mSecurity as Code: A DevSecOps Approach
55mCodified Security
45mCode Red: The Business Impact of Code Quality
55mIs this okay!? How to review code for security issues
37mSecurity Doesn't Have To Be a Nightmare
23mSecure Code, Safe Future: Mastering Security in Critical Software Development