The "stay on the golden path" rule is unrealistic except in corporate Java environments. It will conflict with other more important focus points than security:

The "stay on the golden path" rule is unrealistic except in corporate Java environments. It will conflict with other more important focus points than security: disruption, be faster than competition, do things thee hard way, etc. (All things well described in pg's essays). I would require all devs to read OWASP and make sure they understand the core, then they can tweak in, hopefully knowing what they do.