Podcast · Tech & Science

DevSec Station

by Tanya Janca | SheHacksPurple · English · Tech & Science

DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you level up.

New episodes: Every two weeks
Typical length: 7 min
Latest: 8 Oct 2026
Language: English

Latest episode

8 Oct 2026 · 9 min

Your AI Worked 59 Times. What About the 60th?

What happens when your AI assistant does exactly what you expect 59 times... and then does something completely bananas on the 60th? While teaching a secure coding class, I watched nearly 60 students use the same AI assistant, programming language, and prompts. For 59 of them, everything went as expected. But one student's AI-generated Python code included instructions to suppress linting checks, followed by code that leaked secrets to an external file. The AI hadn't escaped a sandbox. It ...

Play episodeWhatsApp Download

Earlier episodes 13 most recent

S1 · E12 · 23 Sep 2026 · 7 min
Security Requirements: What They Are and How to Add Them to Your Project
Security problems don't generally happen because developers 'don't care' or lack skill. They happen because no one clearly defined what "secure" meant in the first place. When security expectations are left implicit, developers are forced to guess. And that's where vulnerabilities are born. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains what security requirements are, why they're one of the most overlooked secure development practices, and how devel...
S1 · E11 · 9 Sep 2026 · 7 min
Threat Modeling for Developers (How To)
Threat modeling has a reputation for being complicated, full of diagrams, and requiring long meetings. In reality, most developers already do it, they just don't realize it. The difference is that doing it intentionally helps you catch security problems before they become security incidents. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca breaks threat modeling down into a simple five-step process that any developer can use while designing a feature. You'll l...
26 Aug 2026 · 9 min
How to Do Secure Code Review (When You’re Not a Security Expert)
Secure code review isn't about finding obscure vulnerabilities or thinking like an elite hacker. It's about verifying that the security controls your application depends on are actually present, in the right place, and correctly implemented. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains how developers can perform effective secure code reviews without being security experts. You'll learn what security controls to look for, how trust boundaries help ...
S1 · E9 · 12 Aug 2026 · 8 min
The Most Common Secure Coding Mistakes Good Devs Make
Security bugs aren't usually caused by 'bad developers'. More often, they're the result of good developers making rational decisions under deadlines, competing priorities, and imperfect systems. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explores why common secure coding mistakes are often incentive problems rather than knowledge problems. You'll learn why insecure patterns emerge, why simply telling developers to "be more careful" doesn't work, and how ...
S1 · E8 · 29 Jul 2026 · 7 min
Secure Defaults Beat Secure Training
Security training has its place. But if training alone solved security problems, we wouldn't keep seeing the same vulnerabilities appear over and over again. The real problem usually isn't that developers don't know what to do; it's that the easiest path is often an insecure one. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains why secure defaults are one of the most effective security controls you can implement, why relying on memory and willpower ra...
S1 · E7 · 15 Jul 2026 · 6 min
Why Current Security Tools Fail Developers
Security tools are supposed to help developers build safer software. But sometimes it seems like they create more frustration than security. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains why many security tools overwhelm developers with alerts, how alert fatigue erodes trust, and why "more findings" doesn't mean "more security." You'll learn how to tune your classic AppSec tools so they surface meaningful issues instead of creating noise that every...
S1 · E6 · 1 Jul 2026 · 8 min
Vibe Coding, Copilots, and Security Drift
AI coding assistants can help developers move incredibly fast. But this new speed comes with a new challenge: security drift. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explores how tools like GitHub Copilot, ChatGPT, Cursor, and other AI coding assistants can unintentionally change the security assumptions your software was built on. You'll learn what security drift is, why it happens so quietly, and how to keep the benefits of AI-assisted development w...
S1 · E5 · 18 Jun 2026 · 7 min
Secrets Management: Stop Playing Whack-a-Mole
If you've ever committed an API key, password, token, certificate, or other secret to a repository, you're not alone. Most secret leaks don't happen because developers don't care about security. They happen because the easiest place to put a secret is inside the code that uses it. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains why secrets leak, why "just be careful" isn't an effective security strategy, and how developers can stop playing whack-a-mo...
S1 · E4 · 4 Jun 2026 · 7 min
Supply Chain Is More Than Just Dependencies
Most developers think software supply chain security starts and ends with dependencies. But modern supply chain attacks don't stop there. Attackers look for paths into your software, and those paths often run through developers, CI/CD systems, build tools, deployment pipelines, and other trusted parts of the software delivery process. This episode is sponsored by Maze. In this episode of DevSec Station, Tanya Janca explains why the software supply chain is much bigger than libraries and pac...
S1 · E3 · 21 May 2026 · 8 min
Malicious Dependencies Aren’t an Accident
Malicious dependencies are not accidents. They are often intentionally designed to look trustworthy so developers install them without hesitation. In this episode of DevSec Station, Tanya Janca explains how attackers use typosquatting, dependency confusion, fake packages, and even AI-generated recommendations to compromise developer environments and steal credentials. This episode is sponsored by Maze. You’ll learn: • how malicious packages trick developers • why dependency attacks work...
S1 · 22 Apr 2026 · 2 min
NPM Supply Chain Attack: Active Worm Stealing Tokens, SSH Keys, and Credentials
🚨 Emergency DevSec Station update. There’s an active npm supply chain attack happening right now. Malicious npm packages are running install scripts that quietly steal: • SSH keys • AWS credentials • GitHub tokens • Browser passwords • Crypto wallets From there, the attack uses your npm publish token to spread into every package you maintain. That’s how this turns into a worm across the npm ecosystem. This is not theoretical. It’s already in the wild. 👉 Immediate...
S1 · E2 · 14 Apr 2026 · 10 min
How Modern Supply Chain Attacks Really Happen (Step-by-Step Breakdown for Developers)
What if a supply chain attack didn’t start with a complex exploit… but something completely normal? A typo. A copy-paste. Even an AI suggestion. In this episode, Tanya Janca breaks down how modern supply chain attacks actually happen inside everyday developer workflows. These attacks aren’t one big moment. They’re a series of small, reasonable decisions that quietly introduce risk. You’ll learn: • Why supply chain attacks are a process, not a single event • How attacke...
S1 · E1 · 21 Mar 2026 · 6 min
Developers Are Now Targets: How Supply Chain Attacks Actually Reach You
Developers are no longer just building software. They’re being targeted directly. In this episode, Tanya Janca explains how supply chain attacks reach developers through everyday tools, packages, and workflows. These attacks don’t feel like attacks at first. They look like normal development work until it’s too late. You’ll learn: • How supply chain attacks reach individual developers • Why developer environments are now high-value targets • Where risk shows up in dail...

About DevSec Station

DevSec Station is a English tech & science podcast from Tanya Janca | SheHacksPurple. Melo plays each episode straight from the publisher's own feed — no ads added, no account needed — and remembers where you stopped, in this browser only.

Publisher: Tanya Janca | SheHacksPurple
Language: English
Category: Tech & Science
New episodes: Every two weeks
Typical length: 7 min
Latest episode: 8 Oct 2026
Feed: RSS — paste into any podcast app
Apple Podcasts: podcasts.apple.com/podcast/id1887122646

RSS feed Apple Podcasts

More English tech & science

Take it with you

The Melo app keeps playing with the screen off, works in the car and on your watch, wakes you to your station, and browses the whole catalogue offline. Free, no ads, no account.