Building Secure C++ Applications - A Practical End-to-End Approach

Learn actionable strategies for building secure C++ applications throughout the entire software development lifecycle in this conference talk from CppCon 2025. Discover concrete techniques and tools to proactively mitigate common C++ security vulnerabilities at each development stage, from initial coding to final release, drawing from practical experience in Microsoft Edge browser development. Explore developer-focused practices including leveraging libc++ bounds checking, compiler warnings like -Wunsafe-buffer-usage, strong types, and lifetime management with weak_ptr best practices and Chromium WeakPtr. Master initialization safety, arithmetic and thread safety techniques, and learn to prevent ODR violations and undefined behavior while utilizing fuzzers and compile-time checks. Examine critical post-development phases including robust presubmit checks, security-focused code reviews, continuous ASAN/MSAN testing, and release strategies that incorporate experimentation, GWPAsan, and bug bounty programs. Gain practical insights from Microsoft Edge development team members Chandranath Bhattacharyya and Bharat Kumar as they share real-world approaches to creating more secure C++ software from conception to deployment.