Learnings from 5 years of tech startup code audits (kenkantzer.com)

Article summary

The article discusses the author's learnings from 5 years of tech startup code audits, highlighting key takeaways such as the importance of simplicity, the ease of writing secure software, and common security vulnerabilities. The author also notes that monorepos are easier to audit and that custom fuzzing is an effective testing method. Additionally, the article touches on the challenges of securing dependencies and the importance of identifying security enthusiasts within engineering teams. The author reflects on the evolution of security practices and the need for continuous improvement.

Main themes

• security best practices
• code auditing
• monorepos
• JWTs and authentication
• fuzzing and testing
• dependency security
• engineering team dynamics
• security expertise and education
• authentication protocols and standards
• software development and security tradeoffs

What commenters say

• Some commenters argue that JWTs are unnecessary and introduce unnecessary complexity, while others see them as useful in certain scenarios.
• There is disagreement on the effectiveness of monorepos, with some finding them easier to audit and others experiencing difficulties with discoverability.
• The use of cookies versus JWTs for authentication is debated, with some arguing that cookies are simpler and more secure.
• Some commenters suggest that security should be a primary consideration from the outset, rather than an afterthought.
• The importance of identifying and leveraging security expertise within engineering teams is highlighted.
• There are differing opinions on the value of fuzzing and other security testing methods.
• Some argue that security is often an afterthought in software development, and that this can lead to significant vulnerabilities.
• The need for secure and well-documented authentication protocols is emphasized.