The Pragmatic Engineer Code security for software engineers
167 snips
Nov 26, 2025 
Johannes Dahse, VP of Code Security at Sonar and a seasoned security expert, dives into the essentials of code security for software engineers. He passionately argues for developer ownership of security while security teams act as enablers. Topics include practical strategies for writing secure code, the risks of dependencies, and the role of AI in coding practices. Johannes also addresses pressing issues like the state of vulnerabilities, dynamic testing methods, and the importance of maintainability in reducing security risks.
AI Snips
Chapters
Transcript
Episode notes
From Getting Hacked To Becoming A Hacker
- Johannes Dahse got into security after his personal computer was infected and he became obsessed with capture-the-flag competitions.
- That early curiosity led to professional penetration testing work and eventually to Sonar.
Shared Responsibility With Developer Ownership
- Code security is a developer-owned responsibility while broader application security suits a dedicated security team.
- Security teams should focus on specialized, high-expertise problems and enable developers with tooling and guidance.
Know Your Code And Validate Inputs
- Understand exactly what your code does and where inputs flow through it when working on security-sensitive features.
- Treat all external data as untrusted and validate or sanitize inputs before using them in file, SQL, or HTML contexts.