Cross-platform · Secure systems
Security Is a Feature
A developer's field guide for 2026
Start treating security as ordinary product work with a free tool stack and a practical 30-day plan.
“It made me think about security in a completely different way, and it's full of practical insights that every developer should know!!!”
Field guide · 30-day plan
Mike Salari · Staff mobile engineer · 500+ technical interviews from the hiring side
Secure checkout on Gumroad.Instant PDF and EPUB download.Lifetime updates.
What is inside
Security Is a Feature in its own order: what each part teaches, so you can see whether it covers the round you have next.
- 01
The premise and the definition
Sets out the argument that security deserves the same treatment as any product feature, and names the four traits that make something a feature.
- 02
Why security gets skipped
Explains why security behaves like infrastructure, invisible until it fails, and why fixing it late costs so much more.
- 03
What it costs in 2026 and the new threat surface
Sourced breach and fine figures, then three shifts: supply chain attacks on dependencies, AI written phishing, and the risks of shipping LLM features.
- 04
Security as testing and the payoff
Treats security checks as tests in the pipeline, then covers what teams gain: higher attack cost and a product buyers can trust.
- 05
The free tool stack and the 30-day plan
A no-budget toolchain and a four-week plan: get visibility, set a baseline, probe the running app, then make it part of the definition of done.
- 06
Keep going
A short reading shelf and living references such as OWASP, CISA and OpenSSF for going deeper.
Is it the right book for you?
Who gets the most from it, and when a different book is the better use of your time. The last list is as important as the first.
Use it when
- Security keeps losing the roadmap fight on your team and you need an argument that treats it as feature work.
- You want a concrete first month of security work with free tools and no budget request.
- Your product now calls an LLM and you want to know which new risks to test first.
- You are a lead who needs a short, sourced document to share with the team before changing the definition of done.
Skip it when
- You are looking for interview triage or practice answers for a mobile system design interview.
- You need a deep technical text on cryptography, threat modelling or mobile platform security internals.
- Your team already runs dependency scanning, secret scanning, static analysis and DAST in CI with owners and targets.
- You want a long book; this is a short field guide.
By level
- Junior
- A clear picture of why security work matters and a first set of free tools to turn on.
- Mid
- A week-by-week plan you can run in one repo without asking for budget.
- Senior
- Sourced figures and a framing to win the prioritisation argument with product.
- Lead
- A plan that ends with a standing security budget and a security line in the team's definition of done.
What a page looks like
A short illustrated field guide in ten numbered sections. Each section is a page or two with a headline claim, a few sourced figures or cases, and practical points. The plan section lays out four weeks with three concrete actions each.
The facts
- Field guide
- 30-day plan
- Last updated 5 Aug 2026
- Levels: junior, mid, senior, lead
What readers wrote
★★★★★
Idk why are there no reviews for this book?!!! This is is amazing. It made me think about security in a completely different way, and it's full of practical insights that every developer should know!!!
Questions buyers ask
Short answers about Security Is a Feature, from the book itself and the store page.
Is it really free?
Yes. The catalog lists it as free, and the guide itself says it is free to share.
What format is it?
A developer field guide with ten short sections and a 30-day plan. It is a quick read, not a full book.
Do I need to buy tools to follow the plan?
No. The guide is built around a free toolchain and says the plan needs no budget.
Is this interview prep?
No. It is about making security routine product work. For interview practice, look at the other books in the catalog.
Where do the numbers come from?
The guide says every figure is sourced at the back, and it names sources such as IBM and Verizon next to the figures.
Where is it sold?
On Gumroad, at the price shown there (Free when this page was built). Gumroad handles payment, the receipt and the download.