Secure Software Development Practices

Secure Software Development Practices
< /> SECURE DEVELOPMENT OWASP Top 10 (common vulnerabilities): A01 Broken Access Control A02 Cryptographic Failures A03 Injection (SQL, XSS, etc.) A04 Insecure Design A05 Security Misconfiguration A06 Vulnerable Components A07 Auth Failures A08 Software Integrity Failures Shift-left: build security in from design never store secrets in source code

The OWASP Top 10, shifting security left in the development lifecycle, and how to handle secrets and dependencies.

Secure Software Development Practices

Build security into software from the start. Fixing a vulnerability in production costs about 30 times what it costs to catch during design.

Shift Left: Security at Every Stage

SECURE SDLC — security activities at each phase REQUIREMENTS Define security requirements Threat modelling DESIGN Secure architecture Least privilege Design review DEVELOPMENT Secure coding guidelines, SAST Code review TESTING SAST, DAST, SCA Pen testing Security testing DEPLOYMENT Secrets management Infra hardening Config review OPERATIONS Monitoring, patching Vulnerability mgmt Continuous security Cost to fix a bug: $100 in Requirements → $1,500 in Testing → $10,000+ in Production

The OWASP Top 10

The Open Web Application Security Project (OWASP) publishes the most common web application vulnerabilities. Developers should know these:
Rank Vulnerability Simple Example
A01 Broken Access Control User can access another user’s data by changing the URL
A02 Cryptographic Failures Storing passwords in plain text; using HTTP not HTTPS
A03 Injection SQL injection: '; DROP TABLE users;-- in a login field
A04 Insecure Design No rate limiting on login, so an attacker guesses passwords indefinitely
A05 Security Misconfiguration Default admin credentials left enabled
A06 Vulnerable Components Using a library with a known CVE
A07 Auth Failures Session tokens that never expire
A08 Integrity Failures Deploying code without verifying its source
A09 Logging Failures No audit trail of who accessed what data
A10 SSRF App fetches URLs from user input without validation

SQL Injection: A Visual Example

SQL INJECTION — how user input becomes a database command INTENDED QUERY: SELECT * FROM users WHERE user=’alice’ AND pass=’secret’ ATTACKER INPUTS: ‘ OR ‘1’=’1 RESULTING QUERY: SELECT * FROM users WHERE user=” OR ‘1’=’1′ AND pass=” ⟹ ‘1’=’1′ is always TRUE — returns ALL users
⛔ Important
Never concatenate user input directly into SQL queries or shell commands. Use parameterised queries, also called prepared statements. This one practice prevents the most common class of serious web application vulnerabilities.

Secrets Management

API keys, database passwords, and credentials must never be stored in code:
⚠ Warning
Developers commit thousands of AWS keys, database passwords and API secrets to public GitHub repositories every day. Once a secret reaches version control history, treat it as compromised. Deleting it does not remove it from git history. Use environment variables or a secrets manager (HashiCorp Vault, AWS Secrets Manager) instead.

Dependency Security (SCA)

Your application probably pulls in hundreds of third-party libraries, and any of them may carry vulnerabilities:
  • Run Software Composition Analysis (SCA) tools to detect vulnerable dependencies
  • Subscribe to vulnerability notifications for libraries you use
  • Update dependencies on a schedule, not only when a feature requires it

Mobile Techs IT Consulting

Building or buying software for your business?

One vulnerable app or misconfigured server can expose everything behind it. Mobile Techs IT Service helps Gold Coast businesses keep their software stack secure: vetting and hardening business applications, keeping systems and dependencies patched, locking down default configurations, and securing the websites and servers you rely on. Home users welcome too, on-site or remote, anywhere in Australia.

Get your applications security-checked Talk to us first

Call 1300 644 588  ·  office@mobiletechs.com.au
More on our managed IT services and remote security audit.

Cryptography and PKI Fundamentals
Cryptography and PKI Fundamentals
June 30, 2026
Threat Intelligence and Advanced Persistent Threats
June 30, 2026
Threat Intelligence and Advanced Persistent Threats