Once a security issue's been found, whether by a scan, a review, or your own testing, a natural question comes up: does the actual fix need to go to a security specialist, or can the developer who already built the app just handle it? The honest answer splits the work into two separate skills, and they're not equally distributed across every capable developer.
The skill of implementing a known fix
Once a specific problem is clearly identified, turn on row-level security here, move this key server-side, add a rate limit to this endpoint, implementing the actual fix is usually well within reach of any competent developer, generalist or specialist, especially with an AI coding tool helping write the specific change. This part of the work doesn't usually require deep security expertise. It requires clear instructions and the same care any code change deserves.
The skill of finding what actually needs fixing
This is the part that benefits genuinely from someone who's specifically trained to think like an attacker: someone who knows to try changing an ID in a request, who knows the common shapes these bugs take across different frameworks, who's seen enough real incidents to recognize a pattern a generalist might build confidently and never think to question. A generalist developer, however skilled at building features, isn't automatically equipped with this specific, adversarial way of looking at their own work, because it's a different discipline, not a lesser version of the same one.
Why this split matters for how you actually spend money
Paying a premium for a security specialist to implement a well-understood, already-identified fix is often not the most efficient use of that expertise. Their real value is in the finding, not the typing. Conversely, asking a generalist developer to independently discover the full scope of an app's security gaps, without any specific security-focused review ever having happened, asks them to do a job they were never specifically trained for, regardless of how good they are at building features.
A reasonable way to split the work
- Bring in a security-focused review, whether a person or a dedicated tool, specifically to find what needs fixing. This is the part where specific expertise earns its cost.
- Once findings are clear and specific, your regular developer, or you yourself with an AI coding tool's help, can usually implement most of the actual fixes.
- Reserve ongoing security-specialist involvement for anything genuinely complex: custom authorization logic across many features, anything you don't fully understand the mechanism of, anything touching money where a subtly wrong fix is worse than the original bug.
The question isn't really "do I need a security expert" as a blanket yes or no. It's "which half of this specific job am I asking someone to do," and being clear about that split usually gets you a better result for less money than assuming one type of person has to handle the whole thing end to end.