My belief is that the mentorship comes from the code[1]. Juniors (+ new hires) copy the existing code. They don't avoid sql injection because they think it's b

My belief is that the mentorship comes from the code[1]. Juniors (+ new hires) copy the existing code. They don't avoid sql injection because they think it's bad, they avoid it because they're adapting your code. When they're asked to make a page that does X, they just copy a page that almost does X somewhere else in the system. Maybe one day they read a list of the top 10 vulnerabilities and realize why you did it that way. It's why loads of developers can add new functionality just fine, but ask them to build a whole new app from scratch and you will get an incomprehensible mess. Of course, this doesn't work too well when your code base is a mess of competing styles, etc. [1] Not that I'm saying some additional help wouldn't be good, but that the significant amount can be learnt alone, with no guidance, from the code base.