Just because you have observed many without a strong interest in security, how would you know that there isn't also many who do? I do, but I wouldn't say strong

Just because you have observed many without a strong interest in security, how would you know that there isn't also many who do? I do, but I wouldn't say strong interest because I don't encounter it in my day to day. As an implementer of APIs, most security concerns are done during auth. The only usual things are care in handing of externally supplied values (e.g. database ids or strings) and maybe redacting some parts in logs. Every now and then a new thing gets made that needs its own set of permission scopes and assignments to apps etc. > development of secure software is primarily led by cybersecurity folks rather than developers themselves "cybersecurity folks" who develop secure software are "developers". What you're really saying is that app feature developers, etc don't focus on security, which they should but only as much as they need to which isn't very much.