Why security deserves a different reputation

When you hear the word "security," what comes to mind? For many developers, it's an image of hackers, attacks, and defenses—often a programmer in a black hoodie working in a dark room. Security tends to surface in the news only when something goes wrong: a major social network leaks passwords, or attackers steal credit card data from an online store.

But security doesn't have to be framed as a reaction to bad news. Like user experience or accessibility, security is a positive, necessary part of building for the web. Treating it as a core practice—rather than an afterthought—makes the topic far less intimidating.

Negative and positive images of security
A hacker in hoodie is a negative security image. A team working on a project together is a positive security image.

The upcoming guides will walk you through how to keep both your business and your users' data safe.

Defining a security vulnerability

In software, when an application doesn't behave as intended, we call it a bug. A bug might display incorrect information or crash on a specific action. A vulnerability—also known as a security bug—is a special subset: a bug that could be exploited for abuse.

Bugs are an everyday part of development. That means vulnerabilities are also introduced into applications regularly. The key is to be aware of the common types of vulnerabilities so you can mitigate them. This isn't unlike minimizing other bugs by following established patterns and techniques.

In fact, most security techniques are simply good programming practices:

  • Validate all user input—check for null values, empty strings, and reasonable data sizes.
  • Ensure no single user can consume excessive resources or time.
  • Write unit tests to prevent security bugs from slipping in accidentally.

Security features vs. vulnerability fixes

Beyond fixing bugs, you need a first line of defense in the form of security features like HTTPS and CORS (more on these acronyms later). Encrypting data with HTTPS may not fix a specific bug, but it protects the data exchanged with users from being intercepted by third parties—a common attack vector.

Who bears the cost of insecurity?

When an application lacks proper security, the impact reaches beyond your own systems.

Impact on users
  • Sensitive information, such as personal data, could be leaked or stolen.
  • Content could be tampered with. A tampered site could direct users to a malicious site.
Impact on the application
  • User trust may be lost.
  • Business could be lost due to downtime or loss of confidence as a result of tampering or system shortage.
Impact on other systems
  • A hijacked application could be used to attack other systems, such as with a denial-of-service attack using a botnet.

Securing your application isn't just about protecting yourself or your business. It's about protecting your users and preventing your site from being used as a launchpad for attacks on other systems.

Next steps

You now understand the difference between security vulnerabilities and security features, and you know that an insecure application affects more than just you. The next guide dives into specific types of attacks to continue demystifying the topic.