What Building a SAST Tool Taught Me About AppSec That 13 Years of Software Engineering Didn't

I've been writing software professionally since 2011. Java, C#, Kotlin, Node.js. Enterprise backends, microservices, APIs, data pipelines. I've shipped production code that millions of people have used without knowing it. I've led teams, reviewed architectures, mentored junior engineers, and done all the things that accumulate into what people call "senior software engineer." And yet, when I decided to transition into application security, I realised I had significant blind spots — not about how