Hacking Secure Coding Into Education

The speakers, both former developers who moved into security, argue that insecure code keeps appearing because developers are rarely taught otherwise. They point to SQL injection, first described decades ago, which still drives major breaches, and to other recurring flaws such as cross-site scripting, path traversal and insecure file upload. Their starting point is that security tooling usually arrives after code is already written, so the fix belongs earlier, in education.

An early effort to persuade universities and schools to change their course materials stalled, so they went into classrooms directly. A high school teacher invited them to run a workshop, students spread the word, and a university later asked them for a full semester course that they had to write as the term went on. Their developer workshops are built around coding tasks that deliberately contain common traps, followed by a hacking phase in which participants attack their own solutions. A short console demo showed a quiz's input checks being bypassed, and the speakers showed how the first proposed fixes also failed.

They close by pointing to a public GitHub repository holding the workshops and course materials, and a YouTube channel with recorded lessons that is being redone with better visuals. They also mention a small path-handling library for Python and Java. The practical takeaway is to teach secure coding early, reuse the free materials, and send feedback to improve them.