Devs might be better than average at discovering and counteracting pwnage, but they're also much higher value targets. They often are the Bank. As a criminal,

Devs might be better than average at discovering and counteracting pwnage, but they're also much higher value targets. They often are the Bank. As a criminal, what credentials do you want - some teen's facebook login? or some dev's admin credentials which you can use to compromise entire databases? What about software signing keys for your malware? Access to someone's software update distribution channels? Some companies strictly separate devs from these things, but not all of them by a long shot - and even when they are, admins aren't going to necessarily be code auditing every single release. One slip is all it takes. Debian builds has been breached. Sourceforge has been breached. Unhacked package managers and credentials already make me nervous. Up your paranoia, and have enough self esteem as to realize you're worth targeting - and know that all the Karate in the world won't protect you from being shot in the back from behind. They won't stake out the Dojo either - it'll be your home or favorite bar.