Most common? Simply not having a security mindset whatsoever day-to-day. If you build anything you should be thinking about security, even if all you're thinkin

Most common? Simply not having a security mindset whatsoever day-to-day. If you build anything you should be thinking about security, even if all you're thinking is why security isn't an issue for some particular project. It's always important to understand where the boundaries are because they will change. I've seen countless examples of people playing fast and loose with security merely because they never thought about it or don't understand the issues. Even today, right this second there are people who are writing code that is vulnerable to sql injection, people writing web app software without sanitizing their inputs, people writing remote execution vulnerabilities, etc, etc. All because they just don't think about it and just don't care. A lot of people have the mindset "oh, who would ever hack me? my app is just small potatoes". And this is how you end up with things like the mirai botnet.