An angle that sometimes helps is reframing security as (business) validation and introducing proper type modeling.
The best thing anybody can do for this is making apis that make `unrepresentable` unsafe things.
`
A classic is password length. Instead of `login(user:str, pwd:str)`, do `login(user:NotEmptyStr, pwd:ValidPwd)`.
This is stuff that must be done in the lower layers, to take advantage of how lazy people is. Do it for the most popular libraries and frameworks and we are talking about real impact.
Is the idea that the attacker is brute forcing the login method and they are less likely to be successful if the input must be passed in an unexpected format?
The best thing anybody can do for this is making apis that make `unrepresentable` unsafe things.
` A classic is password length. Instead of `login(user:str, pwd:str)`, do `login(user:NotEmptyStr, pwd:ValidPwd)`.
This is stuff that must be done in the lower layers, to take advantage of how lazy people is. Do it for the most popular libraries and frameworks and we are talking about real impact.