Carlos Schults carlosschults

Code Security Essentials: What Every Developer Should Know

A comprehensive guide based on a conversation with Johannes Doss, VP of Code Security at Sonar

The Evolution of Security Ownership

Security responsibility in software development has undergone a fundamental transformation over the past two decades. Johannes Doss, who has spent 20 years in cybersecurity—from his early days playing capture-the-flag competitions to professional penetration testing and now leading code security at Sonar—has witnessed this evolution firsthand.

His journey into security began personally: his computer got infected with the Sasser worm, sparking both frustration and intrigue about how someone could gain access to his machine. This led him down a path of security exploration, eventually studying IT security in Bochum, Germany, and competing in hacking competitions where university teams would try to hack each other in isolated environments.

C# 14

Extension members are the headliner. The new syntax enables extension properties, extension operators, and static extension members — all defined in a unified extension block. It's fully compatible with existing extension methods. This is a big deal: you can now attach properties and operators to types you don't own, including interfaces and sealed classes.

The field keyword is the second most impactful quality-of-life change. It allows field-backed properties to eliminate explicit backing fields — the compiler generates the backing field automatically, making code cleaner and more maintainable. Perfect for the "I need some logic in a setter but don't want a manual field" pattern that comes up constantly.

Null-conditional assignment (?.=) lets you use null-conditional operators on the left side of assignments, through constructs like customer?.Order = ....

User-defined compound assignment operators: you can now overload +=, *=, and similar operators. Previously, += w

	public int CalculateSquareOfAge(Person? p)
	{
	int age = p?.Age ?? 0;
	return age * age;
	}

	string? nullableString = "hello";
	string nonNullableString = nullableString;

	public void Foo(string? bar)
	{
	if (!bar.IsNullOrEmpty())
	{
	var length = bar.Length;
	}
	}

	public void Foo(string? bar)
	{
	if (!bar.IsNullOrEmpty())
	{
	var length = bar!.Length;
	}
	}