An angle that sometimes helps is reframing security as (business) validation and introducing proper type modeling.

The best thing anybody can do for this is making apis that make `unrepresentable` unsafe things.

` A classic is password length. Instead of `login(user:str, pwd:str)`, do `login(user:NotEmptyStr, pwd:ValidPwd)`.

This is stuff that must be done in the lower layers, to take advantage of how lazy people is. Do it for the most popular libraries and frameworks and we are talking about real impact.