Why experienced developers can miss security risks
A study of API blindspots and the human factors behind vulnerable code.
Coauthor
A published study connecting developer behavior with API security.
The question
What makes a developer miss a security issue in an API they trust?
My contribution
I coauthored “API Blindspots: Why experienced developers write vulnerable code,” connecting research on cognition and individual differences with software security.
The approach
The study involved 109 developers in four countries solving programming puzzles involving Java APIs. The team examined blindspot detection alongside experience, confidence, cognitive measures, and personality.
What came out of it
Blindspots were associated with poorer identification of security concerns, especially in I/O-related APIs and more complex puzzles. Greater experience or cognitive functioning did not predict better detection; openness was associated with greater detection.
Explore the materials
Continue with the source material behind this case study.
View publication and PDF ↗