2 min lesson
Paved roads and systemic fixes
Walk through each part of "Paved roads and systemic fixes", then explain what each one does.
Step 1 of 3
Paved roads and systemic fixesthe two habits that signal the mindset
- Paved road
- Make the secure path the default. A safe-by-construction client library beats a wiki page telling people to be careful.
- Systemic over one-off
- Kill the class, not the instance. One unsafe API removed prevents the next 50 reports of the same bug.
- Developer empathy
- Design for engineers who move fast; if the secure path costs them ten minutes, they'll find the five-minute unsafe one.
- Adoption as a metric
- Track how many teams are on the paved road, not how many findings you filed.
Learn more
Full explanation
How to demonstrate it in answers
How to demonstrate it in answersthe move that earns the most signal
Whenever you surface a vulnerability in the loop, pair it with a frictionless fix in the same breath. A finding alone reads as an auditor; a finding plus the paved road that retires it reads as the role.
- 1Name the vuln concretely. "This endpoint builds SQL by string concatenation, so it's injectable."
- 2Fix the instance. Parameterize the query right here.
- 3Kill the class. Provide a query helper that only accepts parameters, then lint or block the raw-string path so the bug can't return.
- 4Make it frictionless. Ship the helper as the obvious default in the codebase so the secure call is the shortest call.
I'd fix the injection here, but the real win is making it unwriteable: a query helper that only takes parameters, the raw-string path linted out and that helper as the default in the codebase. One change retires the whole class and engineers get a safer API that's also less work - so they actually adopt it instead of routing around me.
Avoid answers that end at "I'd flag it" or "I'd require a review." In a builder-first loop, stopping at detection reads as the gatekeeper mindset the role is screening against. Always carry the answer through to the frictionless, systemic fix.
Learn more
Optional practice
Practice: Paved roads and systemic fixes
QIn a secure-code-review round you spot a raw-string SQL query that's injectable. What's the builder-first way to handle it and why does it beat just flagging the bug?