DevSec Station

Tanya Janca | SheHacksPurple
  • 0,0 (0)
  • Tecnologia

DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you level up.

  1. 2 gg fa

    Your AI Worked 59 Times. What About the 60th?

    What happens when your AI assistant does exactly what you expect 59 times... and then does something completely bananas on the 60th? While teaching a secure coding class, I watched nearly 60 students use the same AI assistant, programming language, and prompts. For 59 of them, everything went as expected. But one student's AI-generated Python code included instructions to suppress linting checks, followed by code that leaked secrets to an external file. The AI hadn't escaped a sandbox. It wasn't even an agent. It was simply generating code within the boundaries we'd given it. And that's what makes the story so interesting. Welcome to Season 2 of DevSec Station! In this episode, Tanya Janca explores why AI's unpredictable behaviour becomes a security problem when we give it access to files, credentials, tools, infrastructure, and deployment capabilities. We'll discuss: - Why successful AI runs don't guarantee the next run will be safe. - Why better prompts aren't a substitute for security controls. - Least privilege, independent security checks, and human approvals. - How to limit the blast radius when an AI system does something unexpected. ** Your one thing to do this week ** Pick an AI assistant or agent you're using and ask yourself: What's the worst thing it's technically capable of doing with its current permissions? Not what you've asked it to do. What it can *actually* do. Because we don't need AI systems to be perfectly predictable. We need to engineer systems that can safely survive a surprise. DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software. Follow Tanya: https://shehackspurple.cahttps://youtube.com/@shehackspurplehttps://newsletter.shehackspurple.cahttps://linkedin.com/in/tanya-jancahttps://tanyajanca.com

    Your AI Worked 59 Times. What About the 60th?

  2. 23 set

    Security Requirements: What They Are and How to Add Them to Your Project

    Security problems don't generally happen because developers 'don't care' or lack skill. They happen because no one clearly defined what "secure" meant in the first place. When security expectations are left implicit, developers are forced to guess. And that's where vulnerabilities are born. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains what security requirements are, why they're one of the most overlooked secure development practices, and how developers can start adding them to projects today. You'll learn how clear, testable security requirements eliminate guesswork, improve collaboration, and help teams build secure software from the start.  You'll learn:  what security requirements are (and what they are not)  why vague security expectations lead to recurring problems  how security requirements improve design, code reviews, and testing  examples of effective security requirements developers can write today  how to add security requirements to features without creating bureaucracy Tanya walks through a familiar scenario where a feature works exactly as intended, only to be criticized later because security expectations that were never documented are missing. She explains why this isn't a developer failure, it's a communication failure, and shows how a few clear requirements can prevent expensive misunderstandings before development even begins.  If you do just one thing after listening to this episode: Add two or three security requirements to a feature you're currently working on. For example, consider requirements like:  who should be allowed to access the feature  what inputs must be validated (spoiler alert: all of them!) what sensitive data must never be logged  how the application should behave when something goes wrong Then document those requirements somewhere your team will actually see them:  the project requirements document (the best place) a ticket  a pull request description  or somewhere else in the project's documentation When security expectations are written down, developers don't have to guess. They can build the right thing the first time. DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software. Follow Tanya: https://shehackspurple.cahttps://youtube.com/@shehackspurplehttps://newsletter.shehackspurple.cahttps://linkedin.com/in/tanya-jancahttps://tanyajanca.comThis episode is sponsored by Maze. One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that. Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary. Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now. Learn more about Maze https://mazehq.com/devsec

    Security Requirements: What They Are and How to Add Them to Your Project

  3. 9 set

    Threat Modeling for Developers (How To)

    Threat modeling has a reputation for being complicated, full of diagrams, and requiring long meetings. In reality, most developers already do it, they just don't realize it. The difference is that doing it intentionally helps you catch security problems before they become security incidents. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca breaks threat modeling down into a simple five-step process that any developer can use while designing a feature. You'll learn how to identify what you're protecting, where trust boundaries exist, and how to ask a few simple questions that uncover security issues early; before they're expensive to fix.  You'll learn:  why threat modeling is can be simpler than most people think  how to threat model a feature in about fifteen minutes  how to identify assets, entry points, and trust boundaries  three practical misuse questions that reveal common insecure design mistakes  how to turn identified threats into concrete security controls Tanya walks through a practical, developer-friendly approach to threat modeling that doesn't require diagrams, special tools, or security approval. Instead, she demonstrates how asking a handful of structured questions during design helps developers build more secure software from the very beginning.  If you do just one thing after listening to this episode: Threat model one feature you're currently building. Follow these five simple steps:  describe the feature in one sentence  identify what you're protecting  identify the entry points and trust boundaries  ask what could go wrong if the feature is misused or fails unexpectedly  identify at least one security control that should be added or verified Write your notes somewhere your team can see them; a ticket, pull request, markdown file, or design document. You don't need a formal process. You just need to think about security before the code exists. DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software. Follow Tanya: https://shehackspurple.cahttps://youtube.com/@shehackspurplehttps://newsletter.shehackspurple.cahttps://linkedin.com/in/tanya-jancahttps://tanyajanca.comThis episode is sponsored by Maze. One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that. Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary. Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now. Learn more about Maze https://mazehq.com/devsec

    Threat Modeling for Developers (How To)

  4. 26 ago

    How to Do Secure Code Review (When You’re Not a Security Expert)

    Secure code review isn't about finding obscure vulnerabilities or thinking like an elite hacker. It's about verifying that the security controls your application depends on are actually present, in the right place, and correctly implemented. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains how developers can perform effective secure code reviews without being security experts. You'll learn what security controls to look for, how trust boundaries help you focus your review, and a simple framework for turning security review from "vibes" into a repeatable engineering practice that meaningfully increases the security of your code.  You'll learn:  why secure code review is about verifying security controls, not hunting for clever vulnerabilities  how trust boundaries help you focus on the code that matters most  the four areas every developer should examine during a security review  why security issues are often missed during otherwise well done code reviews  how a simple checklist can make security review faster, more consistent, and more effective Tanya walks through a realistic pull request that passes every normal review, yet still introduces security problems because no one explicitly checked authentication, authorization, input validation, or error handling. She explains why these omissions are process problems (not developer failures) and how focusing on security controls makes reviews far more effective.  If you do just one thing after listening to this episode: Add a short security checklist to your team's pull request template. Copy this one! Seriously, right now. Do it.  Does this change introduce new inputs or trust boundaries?  Does it change who can access something?  Does it touch sensitive data, secrets, or credentials?  What happens if this code fails?  Are the expected security controls where they should be and correctly implemented? You don't need a twenty-point checklist. Three to five thoughtful questions are enough to turn secure code review into a repeatable habit instead of a gut feeling. DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software. Follow Tanya: https://shehackspurple.cahttps://newsletter.shehackspurple.cahttps://youtube.com/@shehackspurplehttps://news.letter.shehackspurple.cahttps://linkedin.com/in/tanya-jancahttps://tanyajanca.comThis episode is sponsored by Maze. One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that. Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary. Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now. Learn more about Maze https://mazehq.com/devsec

    How to Do Secure Code Review (When You’re Not a Security Expert)

  5. 12 ago

    The Most Common Secure Coding Mistakes Good Devs Make

    Security bugs aren't usually caused by 'bad developers'. More often, they're the result of good developers making rational decisions under deadlines, competing priorities, and imperfect systems. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explores why common secure coding mistakes are often incentive problems rather than knowledge problems. You'll learn why insecure patterns emerge, why simply telling developers to "be more careful" doesn't work, and how changing your development environment can make secure coding the easiest path forward.  You'll learn:  why good developers still introduce security vulnerabilities  how deadlines, delivery pressure, and operational complexity influence coding decisions  why 'shame and blame' doesn't improve software security  several practical examples of how to replace insecure patterns with more secure ones  how to identify recurring shortcuts and improve them instead of fighting them Tanya shares several real-world examples of secure coding shortcuts that teams make every day (from copy-pasted authentication checks to inconsistent secret handling) and explains why these decisions are understandable in the moment, even though they create security problems over time (also known as 'security drift'). She also demonstrates how small changes to defaults, shared libraries, and team patterns can eliminate entire classes of recurring mistakes.  If you do just one thing after listening to this episode: Identify one insecure pattern that keeps showing up in your team's code base and ask why it exists before trying to eliminate it. If you don't know the why, you can't fix it. Then replace that shortcut with an easier, more secure path. DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software. Follow Tanya: https://shehackspurple.cahttps://newsletter.shehackspurple.cahttps://youtube.com/@shehackspurplehttps://linkedin.com/in/tanya-jancahttps://tanyajanca.comThis episode is sponsored by Maze. One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that. Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary. Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now. Learn more about Maze https://mazehq.com/devsec

    The Most Common Secure Coding Mistakes Good Devs Make

  6. 29 lug

    Secure Defaults Beat Secure Training

    Security training has its place. But if training alone solved security problems, we wouldn't keep seeing the same vulnerabilities appear over and over again. The real problem usually isn't that developers don't know what to do; it's that the easiest path is often an insecure one. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains why secure defaults are one of the most effective security controls you can implement, why relying on memory and willpower rarely works under pressure, and how small changes to your development workflow can prevent the same mistakes from happening again. You'll learn why better systems consistently outperform good intentions.  You'll learn:  why training alone isn't enough to improve security  how insecure defaults quietly create recurring security issues  why developers naturally follow the path of least resistance  how secure defaults reduce mistakes without slowing teams down  practical ways to improve security by changing one default at a time Tanya walks through a familiar day in the life of a busy developer, showing how insecure defaults become "normal" simply because they're already there. She explains why this isn't a developer problem (it's a systems design problem) and how thoughtful defaults can improve security for every future decision.  If you do just one thing after listening to this episode: Choose one repository you actively work on and improve a single insecure default. For example:  update a configuration file so it starts with more secure settings  enable security checks in your CI pipeline to run every time  improve a project template so authentication, logging, or validation are included automatically  replace scripts that rely on plain text secrets to perform proper secret management instead You don't have to redesign your entire development process. One better default today can prevent countless mistakes tomorrow. DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software. Follow Tanya: https://shehackspurple.cahttps://newsletter.shehackspurple.cahttps://youtube.com/@shehackspurplehttps://linkedin.com/in/tanya-jancahttps://tanyajanca.comThis episode is sponsored by Maze. One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that. Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary. Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now. Learn more about Maze https://mazehq.com/devsec

    Secure Defaults Beat Secure Training

  7. 15 lug

    Why Current Security Tools Fail Developers

    Security tools are supposed to help developers build safer software. But sometimes it seems like they create more frustration than security. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains why many security tools overwhelm developers with alerts, how alert fatigue erodes trust, and why "more findings" doesn't mean "more security." You'll learn how to tune your classic AppSec tools so they surface meaningful issues instead of creating noise that everyone eventually ignores. You'll learn: • why classic AppSec tools often optimize for coverage instead of developer workflows • how alert fatigue develops and why it leads to missed vulnerabilities • why developers ignore noise (not security) • how to improve signal-to-noise in your existing tools • practical ways to make security tools work with your development process Tanya walks through a familiar scenario: running a security scan that produces hundreds of findings, spending valuable time triaging alerts, then eventually starting to ignore the noise. She explains why this isn't a developer failure; it's the predictable result of tools that don't distinguish between theoretical issues and meaningful risk. If you do just one thing after listening to this episode: Pick one security tool you already use (SCA, SAST, or a secrets scanner) and tune it to better respect your time. For example: • prioritize high-severity, reachable findings • highlight newly introduced issues instead of historical backlog • filter or downgrade specific types of findings your team never acts on • configure the tool to surface issues as early as possible in your workflow The goal isn't to ignore security, it's to make the important signals very loud and visible. DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software. Follow Tanya: https://shehackspurple.cahttps://newsletter.shehackspurple.cahttps://youtube.com/@shehackspurplehttps://linkedin.com/in/tanya-jancahttps://tanyajanca.comThis episode is sponsored by Maze. One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that. Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary. Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now. Learn more about Maze https://mazehq.com/devsec

    Why Current Security Tools Fail Developers

  8. 1 lug

    Vibe Coding, Copilots, and Security Drift

    AI coding assistants can help developers move incredibly fast. But this new speed comes with a new challenge: security drift. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explores how tools like GitHub Copilot, ChatGPT, Cursor, and other AI coding assistants can unintentionally change the security assumptions your software was built on. You'll learn what security drift is, why it happens so quietly, and how to keep the benefits of AI-assisted development without letting important security controls slowly disappear. You'll learn: • what security drift is and why it matters • how AI-generated code can subtly change security assumptions • why confidence and correctness are not the same thing • how security controls disappear during seemingly harmless refactors • practical ways to add guardrails to AI-assisted development workflows Tanya walks through a realistic example of how authentication checks, input validation, and logging can slowly weaken over time as AI-generated code evolves through multiple edits and refactors. The code still works, the tests still pass, but the security posture is no longer what the team originally intended. One practical action from this episode: Choose one security-sensitive area where AI generates code for you, such as authentication, authorization, input validation, or secrets handling. Then: • identify a known-good secure implementation • require AI-generated code to follow that pattern • add a review step or checklist item • automate enforcement where possible using tests, linters, static analysis, prompts, or a RAG server The goal isn't to slow down or ban AI. It's to prevent AI from making security decisions on your behalf. DevSec Station is a podcast by Tanya Janca (SheHacksPurple), focused on short, practical lessons that help software developers build more secure software. Follow Tanya: https://shehackspurple.cahttps://newsletter.shehackspurple.cahttps://youtube.com/@shehackspurplehttps://linkedin.com/in/tanya-jancahttps://tanyajanca.comThis episode is sponsored by Maze. One of the biggest problems in security right now is that every vulnerability scanner says everything is critical, and honestly, no one has time for that. Maze uses AI agents to investigate vulnerabilities in context, so you can focus on the issues that are actually exploitable in your environment, not just theoretically scary. Their AI agents also generate and prioritize fixes that knock out multiple vulnerabilities at once, which is honestly the kind of scaling that security teams need right now. Learn more about Maze https://mazehq.com/devsec

    Vibe Coding, Copilots, and Security Drift
Elenco completo (14)

Descrizione

DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you level up.

Informazioni

  • Creatore
    Tanya Janca | SheHacksPurple
  • Anni di attività
    2026
  • Puntate
    14
  • Classificazione
    Contenuti espliciti
  • Copyright
    © 2026 SheHacksPurple
  • Sito web del podcast
    DevSec Station

Potrebbero piacerti anche…