Why experienced developers can miss security risks

The question

What makes a developer miss a security issue in an API they trust?

My contribution

I coauthored “API Blindspots: Why experienced developers write vulnerable code,” connecting research on cognition and individual differences with software security.

The approach

The study involved 109 developers in four countries solving programming puzzles involving Java APIs. The team examined blindspot detection alongside experience, confidence, cognitive measures, and personality.

What came out of it

Blindspots were associated with poorer identification of security concerns, especially in I/O-related APIs and more complex puzzles. Greater experience or cognitive functioning did not predict better detection; openness was associated with greater detection.