DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you level up.
Host Alex Stamos explores the unexpected security risks of AI assistants when one student's code reveals secrets, highlighting the importance of vigilance.
23 Sept 2026
Security Requirements: What They Are and How to Add Them to Your Project
Host Tanya Janca explains security requirements, revealing why their absence breeds vulnerabilities and how to integrate them into your project.
9 Sept 2026TRANSCRIPT
Threat Modeling for Developers (How To)
Host Tanya Janca, a renowned security expert, simplifies threat modeling into a five-step process for developers to proactively identify security issues during feature design.
26 Aug 2026TRANSCRIPT
How to Do Secure Code Review (When You’re Not a Security Expert)
Host Tanya Janca interviews developers on DevSec Station, explaining how to perform effective secure code reviews by verifying essential security controls.
12 Aug 2026TRANSCRIPT
The Most Common Secure Coding Mistakes Good Devs Make
Host Tanya Janca interviews industry experts on why good developers make common secure coding mistakes due to systemic pressures, not lack of knowledge.
29 Jul 2026TRANSCRIPT
Secure Defaults Beat Secure Training
Host Tanya Janca interviews industry experts on why secure defaults are more effective than secure training for preventing recurring vulnerabilities.
15 Jul 2026
Why Current Security Tools Fail Developers
Host Tanya Janca interviews listeners about why current security tools frustrate developers, offering insights to improve their effectiveness and reduce alert fatigue.
1 Jul 2026
Vibe Coding, Copilots, and Security Drift
Host Tanya Janca interviews industry experts on how AI coding assistants introduce security drift and how to mitigate its silent risks.
18 Jun 2026TRANSCRIPT
Secrets Management: Stop Playing Whack-a-Mole
Host Tanya Janca interviews industry experts on preventing secret leaks by moving beyond "just be careful" security strategies.
4 Jun 2026TRANSCRIPT
Supply Chain Is More Than Just Dependencies
Host Tanya Janca explores the expansive nature of software supply chain security beyond just dependencies, revealing critical attack vectors in this interview.
21 May 2026
Malicious Dependencies Aren’t an Accident
Malicious dependencies are not accidents. They are often intentionally designed to look trustworthy so developers install them without hesitation. In this episode of DevSec Station, Tanya Janca explains how attackers use typosquatting, dependency confusion, fake packages, and even AI-generated recommendations to compromise developer environments and steal credentials. This episode is sponsored by Maze. You’ll learn: • how malicious packages trick developers • why dependency attacks work...
22 Apr 2026
NPM Supply Chain Attack: Active Worm Stealing Tokens, SSH Keys, and Credentials
🚨 Emergency DevSec Station update. There’s an active npm supply chain attack happening right now. Malicious npm packages are running install scripts that quietly steal: • SSH keys • AWS credentials • GitHub tokens • Browser passwords • Crypto wallets From there, the attack uses your npm publish token to spread into every package you maintain. That’s how this turns into a worm across the npm ecosystem. This is not theoretical. It’s already in the wild. 👉 Immediate...
14 Apr 2026
How Modern Supply Chain Attacks Really Happen (Step-by-Step Breakdown for Developers)
What if a supply chain attack didn’t start with a complex exploit… but something completely normal? A typo. A copy-paste. Even an AI suggestion. In this episode, Tanya Janca breaks down how modern supply chain attacks actually happen inside everyday developer workflows. These attacks aren’t one big moment. They’re a series of small, reasonable decisions that quietly introduce risk. You’ll learn: • Why supply chain attacks are a process, not a single event • How attacke...
21 Mar 2026
Developers Are Now Targets: How Supply Chain Attacks Actually Reach You
Developers are no longer just building software. They’re being targeted directly. In this episode, Tanya Janca explains how supply chain attacks reach developers through everyday tools, packages, and workflows. These attacks don’t feel like attacks at first. They look like normal development work until it’s too late. You’ll learn: • How supply chain attacks reach individual developers • Why developer environments are now high-value targets • Where risk shows up in dail...
Inside a recent episode
Threat Modeling for Developers (How To)
Published 9 Sept 2026 · Transcript excerpt
[…] That's it, seriously. The goal is not to predict every single possible attack. It's to notice obvious problems before they turn into security incidents and then fix them. Developers do this informally, literally, all the time. You add a new endpoint and you think, hmm, should this be authenticated? I should add authentication. You store something new in the database and you think, is this sensitive? You integrate a service and you think, oh, what's going to happen if this goes down? If this goes down, then what? What should I do? That's literally you threat modeling. The difference is that when we do it casually, it's very easy to miss things. […]
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
