Alice and Bob Learn Application Security versus Web Security for Developers.
Both show up on every "best" list. They're not competitors. They're a sequence. Here's which one to read first, and when.
Reviewed by Ashish Sheth · Updated August 2026
Author
Tanya Janca
Malcolm McDonald
Pages
288
216
Published
2020
2020
Publisher
Wiley
No Starch Press
Level
beginner
beginner
Amazon Rating
4.7/5 (225)
4.6/5 (108)
Goodreads Rating
4.27/5 (133)
4.02/5 (122)
Alice and Bob Learn Application Security
Strengths
+ Friendly, encouraging tone that lowers the barrier to a hard topic
+ Covers the whole lifecycle, not just a list of vulnerabilities
+ Practical checklists and exercises at the end of each chapter
+ Strong on the people and process side of security, not only the code
Caveats
− Breadth over depth; each topic is an introduction rather than a deep dive
− Language-agnostic, so few copy-paste code examples for your stack
− Experienced security engineers may find the early chapters too basic
Web Security for Developers
Strengths
+ Short and readable; you can finish it in a weekend and act on it
+ Explains each attack with just enough theory before the fix
+ Written for developers, so the advice maps straight onto real code
+ A gentle on-ramp for anyone intimidated by security books
Caveats
− Deliberately broad and shallow; specialists will find it basic
− Light on modern single-page-app and API-specific concerns
− Not a reference you keep coming back to after the first read
The verdict
Alice and Bob Learn Application Security is the stronger pick overall, but Web Security for Developers may suit you better if you're a web developers who never took a security class and want to catch up fast.
Alice and Bob Learn Application Security
Check Price on Amazon →
Web Security for Developers
Check Price on Amazon →
Frequently asked
Which is better, Alice and Bob Learn Application Security or Web Security for Developers?
Alice and Bob Learn Application Security is the stronger pick overall, but Web Security for Developers may suit you better if you're a web developers who never took a security class and want to catch up fast.
Is Alice and Bob Learn Application Security good for beginners?
Yes, that is exactly who it is written for. Tanya Janca assumes little security background and builds up fundamentals, secure design, and coding practices in a warm, encouraging voice. About 130 Goodreads readers rate it around 4.3. Experienced security engineers may find the early chapters slow, but newcomers get a clear map.
Is Web Security for Developers good for beginners?
Yes. It assumes you can build a web app but have never studied security. Malcolm McDonald walks through each major attack with a short explanation and a concrete fix, so a working developer can follow along without a security background. Around 120 Goodreads readers rate it about 4.0, and most praise how approachable it stays.