# Security at scale: Preventing thousands of vulnerabilities without developer friction

DevFeed: [Security at scale: Preventing thousands of vulnerabilities without developer friction](<https://devfeed.tech/articles/security-at-scale-preventing-thousands-of-vulnerabilities-without-developer-friction-22557.md>)

Original publisher: [Read original article](<https://medium.com/mercadolibre-tech/security-at-scale-preventing-thousands-of-vulnerabilities-without-developer-friction-b991d049c543?source=rss----5011f85401f0---4>)

Author: Rodrigo Fernandez Apas

Published: 2026-01-06T13:28:53Z

Content type: article

Language: en

Sources: [Mercado Libre Tech](<https://devfeed.tech/sources/mercado-libre-tech.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>), [Microservices](<https://devfeed.tech/topics/microservices.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [developer](<https://devfeed.tech/tags/developer.md>), [framework](<https://devfeed.tech/tags/framework.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [paved-road](<https://devfeed.tech/tags/paved-road.md>), [sast](<https://devfeed.tech/tags/sast.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Mercado Libre describes centralizing security protections in development frameworks and platform layers across an environment of around 20,000 developers and 35,000 microservices. The company reports that about 95% of SSRF, XSS, and CSRF vulnerability reports are now unexploitable without extra developer work.

## Source excerpt

At Mercado Libre's scale, with around 20,000 developers and 35,000 microservices, security can't depend on every developer remembering flags, settings, or patterns. That approach simply doesn't scale. To tackle this, over the past few years, we've centralized our defenses within our development frameworks (such as HTTP clients and frontend frameworks) and underlying platform layers (like the HTTP routing layer). This strategy has let us achieve broad protection against common vulnerabilities such as SSRF (Server-Side Request Forgery), XSS (Cross-Site Scripting), and CSRF (Cross-Site Request Forgery). As a result, about 95% of these types of vulnerability reports are now unexploitable, without extra work from developers. In this post, we'll share our strategy, development pipeline, case studies, and key learnings from rolling out these protections. From "shift left" to "paved road"The root of the issue Many developer tools and APIs aren't designed with security in mind. For example, Java's `DocumentBuilderFactory` for XML parsing is, by default, vulnerable to XML External Entity (XXE) attacks. Preventing XXE requires configuring several additional settings: That's quite a lot to remember! Expecting every developer to recall and apply all these configurations at every stage is a heavy burden. On the other hand, Golang's XML package makes XXE vulnerabilities much less likely. You really need to make an effort to be vulnerable to XXE. You can use it without worrying about adding extra settings. These examples highlight the complex reality developers face: Unexpected insecurity: It's really easy to burn yourself without realizing it. Choice overload: On top of development and design choices, you also have to make the right security decisions. Shifting responsibilities: Developers often get blamed for insecure choices, even when these could be addressed by the platform. Additionally, common security practices pose their own challenges: In our complex environment, SAST (St