In this session a currently provisional member of the Drupal Security Team gives a broad overview about how security bugs are present and could be prevented on Drupal projects with a special focus on API-like applications to raise awareness for decoupled approach from security perspectives.