You are thinking TOO high (OWASP, compliance, etc.). This must start at the bottom: The language, the DB/Store, Privacy, the management of secrets. Only recen

You are thinking TOO high (OWASP, compliance, etc.). This must start at the bottom: The language, the DB/Store, Privacy, the management of secrets. Only recently this more or less have start to get some traction (Rust, Apple insistence, etc). But as long JS, C, Java, C++ rule and they don't have "secure code per default" and "the login sample use proper APIs" everything else is impossible.