SecureByDesign
title: Secure by Design radar_quadrant: Techniques radar_ring: Assess radar_position: inner created: 2026-05-22 last_updated: 2026-05-22 related: ["SelfHostedSecurityReview", "PythonSecurityAuditBandit", "TwelveFactorApp"]
Secure by Design is an approach to software security in which safety properties are enforced by the structure of the developer ecosystem — programming languages, libraries, frameworks, and deployment tooling — rather than by individual developer vigilance. The central claim, documented in Google's 2024 security engineering whitepaper by Christoph Kern, is that a software product's security posture is an emergent property of the ecosystem in which it is built.
The technique begins with stating security properties as invariants — properties that a system must ensure hold no matter what, even under active attack. Examples:
- All network traffic traversing untrusted networks uses TLS
- Every API request is mediated by an authentication and authorization policy
- For all call sites of a SQL query API, all untrustworthy parameters are bound as query parameters (not string-concatenated)
Stating invariants in "for all..." form exposes why guidance like "use prepared statements" is insufficient: it requires every developer to never make a mistake across every call site in a large codebase. The invariant framing shifts responsibility from developers to the ecosystem design.
Safe Coding: Security invariants are enforced at compile time through language design, type systems, and framework APIs. Memory-safe languages (Go, Rust, Java) eliminate memory safety vulnerability classes. At Google, XSS and SQL injection are effectively eliminated in web applications built on their internal frameworks — insecure code does not compile.
Safe Deployment: Every production change is made by trusted automation, pre-validated by trusted software, or made through an audited break-glass mechanism (Zero Touch Prod). No direct human modification of production systems.
Well-lit paths: Opinionated application frameworks assemble vetted components in vetted configurations for common archetypes (web app + microservices + SQL). Secure design is the default path, not a deliberate choice requiring expertise.
Secure by Design sits at Techniques → Assess inner. The invariants-first framing and "shift responsibility from developers to the ecosystem" mindset are directly applicable to any team making language, framework, or tooling choices. The technique operates at a higher level than checklist-driven approaches (Self-Hosted Application Security Review, Python Security Audit with Bandit already on the radar) — it addresses the design of the environment that produces secure software, not the auditing of software after it is written. Zero tooling cost to apply the invariant-framing practice; the Safe Coding element requires deliberate language and framework selection. The remaining gate is a completed project where framework-level invariants (e.g. ORM-enforced parameterised queries, memory-safe language selection) are explicitly chosen over ad-hoc guidance.
