Software Security for Developers • Laur Spilca & Thomas Vitale • GOTO 2026
Author Laurentiu Spilca discusses his book 'Software Security for Developers', covering why developers avoid security, the dangers of reinventing standards like OAuth 2.0, the growing risks of AI-generated code, and the critical need to understand foundational concepts like encryption, hashing, and PKI.
The book “Software Security for Developers” aims to make fundamental security concepts accessible to every software engineer, not just top-level experts. It focuses on the developer’s perspective, providing practical knowledge and examples in Java and Spring that are conceptually applicable to any programming language. The goal is to empower developers to build more secure applications by understanding the “why” behind security practices, without getting lost in the deep mathematical complexities of cryptography.
Bridging the Knowledge Gap in Security
Developers often avoid security because it’s perceived as an overly complex, non-functional requirement that gets in the way of building features. The book tackles this by:
- Focusing on Practical Application: It explains concepts like encryption, hashing, and digital signatures from a usage standpoint. It clarifies why a developer might choose one algorithm over another (e.g., bcrypt vs. Argon2, or RSA vs. ECC) based on its characteristics, rather than its underlying mathematical principles like elliptic curves or prime numbers.
- Building Knowledge Incrementally: The content is structured to build from foundational concepts up to specifications, making the learning curve manageable for developers at all levels. The core belief is that a developer doesn’t need to invent a new encryption algorithm, but absolutely needs to know how existing ones work to use them correctly.
Clarifying Foundational Concepts
A significant source of vulnerabilities is the widespread confusion surrounding basic security terminology. The book seeks to bring clarity to these often-misunderstood topics.
- Encoding vs. Hashing vs. Encryption: There’s a common misunderstanding of these distinct operations. A prime example is the Kubernetes
Secretobject, which is merely Base64 encoded, not encrypted, despite its name. Similarly, Spring Security’sPasswordEncoderperforms hashing—a one-way, irreversible process—which is fundamentally different from reversible encoding. - JWT vs. OAuth 2.0: Many developers mistakenly believe JSON Web Tokens (JWT) are a replacement for OAuth 2.0 or confuse them with a grant type. A JWT is a data format for securely transmitting information, while OAuth 2.0 is a complete authorization framework. Understanding this distinction is crucial for implementing proper authorization flows.
The Danger of Reinventing Security Standards
A recurring and dangerous pattern in software development is the tendency to reinvent security protocols.
“Reinventing standards because you don’t know them is dangerous because it might introduce a lot of vulnerabilities.”
When developers don’t fully grasp standards like OAuth 2.0, they often create their own “JWT flow” that looks similar but omits critical components, such as the authorization code, token expiration, or even the digital signature. This results in a system that is fundamentally insecure. The book strongly advocates for using and customizing standard, battle-tested library implementations (e.g., from the Spring ecosystem). These libraries are vetted by millions of developers, and using them provides a much higher degree of security than a custom, in-house solution.
Navigating the Risks of AI-Generated Code
The rise of generative AI tools introduces a new vector for security risks. Code generated by AI assistants may be insecure, especially if the models were trained on questionable examples from sources like Stack Overflow.
- The Developer Must Guide the AI: The key principle is that the developer must be in control of the AI, not the other way around. You cannot simply ask an AI agent to “secure the endpoint” without providing specific directions.
- AI as an Augmentor: AI amplifies the developer’s existing knowledge. If a developer understands security well, AI can make them more efficient. If they don’t, AI will only help them produce insecure code faster.
- Ultimate Responsibility: The developer’s name is on the commit, not the AI’s. Therefore, the developer remains fully responsible for the security of the code, and they must possess the expertise to guide the tool and validate its output.
The Enduring Importance of PKI and Certificates
In the modern software landscape, understanding Public Key Infrastructure (PKI) and how digital certificates work is more important than ever. This knowledge is essential for:
- Securing Communication: Implementing HTTPS correctly requires an understanding of how certificate authorities (CAs), public/private key pairs, and trust stores function.
- Enterprise Environments: In corporate settings with private PKIs and internal certificates, this knowledge is not optional. Mishandling private keys or failing to validate certificate chains can lead to severe security breaches.