My first website with a login form had the password hardcoded in the JavaScript code, and if the entered password matched it would redirect to a private URL that was just not linked anywhere, but still public if anyone knew the URL, and yes, that URL was also hardcoded in the JavaScript code.
So in terms of security this was basically a "Do not read" banner, with the "private" content just written below it.
Now, this is just a specific example of me not knowing any better in the early days of web development. There are many other domains in programming where you might introduce vulnerabilities if you don't think about what you're doing.
Is there a generic technique to teach students to keep an eye on their code's security, maybe trying to get them into figuratively hacking their own programs and exploit vulnerabilities?