[extrapickles]

What I found helps the most, is to have frameworks that make implementing secure code hard. XSS is much more rare now that most people use Angular or React (plugins can be trouble tough).

[rarecoil]

I assume you mean implementing insecure code hard.

[extrapickles]

Yes, it should be insecure.