> Shouldn't this be a pretty fundamental part of a degree? If you're in school right now for a CS or SWE related degree, I would imagine you're learning how code actually works, how the math actually works, etc.

I’m sorry to say but colleges don’t teach the kinda stuff you’re gonna use day-to-day. They’ll focus on architecture, data structures, algorithms, databases, OS internals theory that only a minuscule number of systems engineers would get to work on. They won’t teach you that in your /login endpoint, if a user is not found, you should verify the password against a pre-computed dummy hash so the response delay matches a real user account workflow to avoid timing attacks. You only learn this on the job under the supervision of a senior mentor.