> Something I've been wondering is, do we really have any evidence that the average Auth0 developer is more of a security expert than any other dev? Security c

> Something I've been wondering is, do we really have any evidence that the average Auth0 developer is more of a security expert than any other dev? Security companies have average developers just like everyone else. They probably do have better domain knowledge from working on their product but they will miss other important things. The real difference in security comes from product management. Almost everyone I've talked to has some sort of risk assessment process where these sorts of things are laid down in great detail. The leading companies will invest in not only trying to discover weaknesses but will plan to mitigate or resolve the issues within a reasonable timeline.