Secure Coding at U-M

Secure coding is the use of best practices through the lifecycle of applications and systems to ensure optimal protection of the data they handle. Utilizing secure coding practices is central to meeting IT professionals’ responsibility for protecting the university’s digital assets.

Many of the resources on this page are free to access with U-M login. Some require payment, particularly if you want a completion certificate. If coding is part of your work at or for U-M, we recommend checking with your department to see if they will fund the paid courses.

Understanding Your Shared Responsibility

Secure Coding and Artificial Intelligence (AI)

Whether you are a professional developer looking to accelerate your work, or a student, faculty, or staff member interested in building applications through natural-language prompts (vibe coding), AI-assisted coding can be a powerful way to learn, prototype, and automate. At the same time, AI-generated code may contain vulnerabilities, insecure defaults, fabricated dependencies, licensing concerns, or logic errors that put the university’s digital assets at risk.

When computer code and applications are intended to be used with institutional data or systems, the speed of AI-assisted development must be balanced with security, privacy, accessibility, and sustainability considerations.

In addition to complying with the requirements in Secure Coding and Application Security (DS-18), follow these guidelines:

  • AI-generated code is untrusted code until it has been reviewed and tested against the OWASP Top 10 Proactive Controls.
  • Do not deploy code you cannot understand, document, maintain, or support.
  • Use only approved AI services with sensitive institutional data.

  • Take a risk-based approach to AI-assisted development. Apply security measures, such as source, license, and security status verification and expert code review, in situations that introduce higher risk to university systems and data.

    Examples of lower-risk tasks:

    • Generating sample code with synthetic data
    • Asking AI to explain an error message
    • Creating a prototype on a local machine
    • Using AI to draft unit tests
    • Refactoring code after human review

    Examples of higher-risk tasks:

    • Using real student, patient, employee, or research participant data in AI prompts
    • Generating logs that contain access tokens, identifiers, or confidential system details
    • Deploying applications for public use
    • Using AI-generated authentication or encryption code
    • Installing AI-suggested packages

Secure Coding Resources

  • Learning Threat Modeling for Security Professionals, 41 minutes LinkedIn Learning (free with U-M login). Threat modeling can identify areas of concern in applications or systems throughout their lifecycle, from development to testing to retirement. If threat modeling starts during the design process, security is built in. Threat modeling can identify both existential threats, and also concerns and vulnerabilities not directly related to malicious actions.
     
  • Programming Foundations: Secure Coding, 94 minutes, LinkedIn Learning (free with U-M login). This course provides a foundational understanding of secure coding best practices.
     
  • Principles of secure coding UC Davis presented on Coursera. A fee may be required to get a certificate for this course. This course introduces you to the principles of secure programming.
     
  • DevOps Foundations: DevSecOps, 65 minutes, LinkedIn Learning (free with U-M login). This course explains how to incorporate security into the DevOps process. 

These assessments may be helpful for understanding how to incorporate the best practices for secure coding in the development process:

  • Structure Application Security Tools and Practices for DevSecOps, Gartner. This assessment covers strategies and tools that can be used to integrate application security throughout a DevOps cycle.
  • A Guidance Framework for Building an Application Security Program, Gartner. This assessment discusses how security and risk management technical professionals can build an application security program using a holistic approach across many areas of practice.
  • Developing Secure Applications, 96 minutes, LinkedIn Learning (free with U-M login). This course builds on the previous section by discussing how to design secure software by addressing vulnerabilities and concerns such as buffer overflows, insecure direct object references, securing sensitive data, and testing software security.
     
  • Dynamic Application Security Testing, 3 hours 24 minutes, Linked in Learning (free with U-M login). This course covers the many options for security testing of applications and code. It includes information about testing methods and how to incorporate them into the development process.

These additional courses offer deep dives into secure coding that can be taken for a fee and result in learning certificates: