Skip to lesson
Exit
The Role & Your Charter1 / 3

1 min lesson

Paved roads and systemic fixes

Walk through each part of "Paved roads and systemic fixes", then explain what each one does.

Step 1 of 3

Paved roads and developer empathythe three habits that signal the mindset

How the builder operates
Paved road
Make the secure path the default. A safe-by-construction client library beats a wiki page telling people to be careful.
Developer empathy
Design for engineers who move fast; if the secure path costs them ten minutes, they'll find the five-minute unsafe one.
Adoption as a metric
Track how many teams are on the paved road, not how many findings you filed.
Learn more

Full explanation

How to demonstrate it in answers

How to demonstrate it in answersthe move that earns the most signal

Whenever you surface a vulnerability in the loop, pair it with a frictionless fix in the same breath. A finding alone reads as an auditor; a finding plus the paved road that retires it reads as the role.

  1. 1Name the vuln concretely. "This endpoint builds SQL by string concatenation, so it's injectable."
  2. 2Fix the instance. Parameterize the query right here.
  3. 3Kill the class. Provide a query helper that only accepts parameters, then lint or block the raw-string path so the bug can't return.
  4. 4Make it frictionless. Ship the helper as the obvious default in the codebase so the secure call is the shortest call.
Say it like this

I'd fix the injection here, but the real win is making it unwriteable: a query helper that only takes parameters, the raw-string path linted out and that helper as the default in the codebase. One change retires the whole class and engineers get a safer API that's also less work, so they actually adopt it instead of routing around me.

Watch out

Avoid answers that end at "I'd flag it" or "I'd require a review." In a builder-first loop, stopping at detection reads as the gatekeeper mindset. Always carry the answer through to the frictionless, systemic fix.

Learn more

Optional practice

Test yourself on Paved roads and systemic fixes

QIn a secure-code-review round you spot a raw-string SQL query that's injectable. What's the builder-first way to handle it and why does it beat just flagging the bug?