Yes and no depending upon seniority and context. Senior developers leading teams should make sure the patterns being used are secure. Junior developers should

Yes and no depending upon seniority and context. Senior developers leading teams should make sure the patterns being used are secure. Junior developers should mostly worry about getting stuff built. Companies of even a modest size should be having audits. Lessons from these audits should be taught to the team. Everyone (on the web dev side) should be familiar with OWASP [1]. The reality, however, is most companies will disregard security because a secure product with no revenue means no business. So revenue comes first, then security. And usually this is only done in a reactive fashion, like when (true story) a huge banking customer’s security audit finds a hardcode password string in your code that allows admin access. Guess it’s time to remove the back door for troubleshooting. [1] https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet