Security mistakes developers usually make

Below are some common mistakes developers make while development. Most of these mistakes will not impact the functionality of the application so tendency is to make the mistake subconsciously. Security should be by design and it is not something we should integrate after the development.

OWASP guidelines should be taken as high priority in addition to this list.

1. Writing sensitive information such as passwords in the paper or sticky notes (be it on your wooden desk, or OS desktop)
2. Sharing credentials between team members
3. Hard-coding sensitive information as plain text, including passwords in the application in configuration files, databases and comments
4. Not encrypting the database
5. Use of untrusted code from public internet forums without proper reviews and corrections
6. Not encrypting and authorizing the communication channels such as API
7. Not following the principle of least privileges
8. Exposing server ports to public
9. Not enforcing password policies (strong password, expiry policy, multi-factor-authentication)
10. Not educating oneself on the secure coding practices
11. Writing SQL in application code, instead of using stored procedures or ORM libraries
12. Not validating/sanitizing user input values at server side
13. Not having a session expiry policy
14. Giving password hints on unsuccessful login attempts
15. Not using custom exception pages, instead expose the debug messages to user
16. No logging and monitoring
17. Not making use of cryptography libraries
18. Not writing unit testing code
19. Not considering strong passwords, or modern captcha methods
20. Not Automating static code analysis tools such as SonarQube
21. Using untrusted sources for downloading libraries