I get that too. I’ve been an appsec person, developer and product owner at different times. I understand your frustration. Ideally I feel security should be b

I get that too. I’ve been an appsec person, developer and product owner at different times. I understand your frustration. Ideally I feel security should be baked in from the beginning with a SDLC process, i.e a friendly security person you can ping/involve from conception through development of a feature. Rather than the all too often 1 week pentest scheduled 1 week before product go live with no time for remediation and no communication with the tester apart from a 20 page report at the end. Online resource wise, dev security material can be sparse, you either have Troy Hunt or someone else warning you about SSL/TLS configurations (I die on this hill, attackers don’t care if you have a C or A+ SSL labs score because usually that’s nothing to do with how you’re going to get hacked) or XSS (hopefully your framework handles this now) but then nothing really breaking down what request smuggling is and how you can protect against it. If you can get a 2 day slot to get a training course in as a dev team with a (decent) security person, that can be really valuable. Gives you enough of a high level overview to get that tingly feeling when maybe something might be a security issue.