We apply a social and cognitive psychological approach to better understand software developers’ perceptions of secure software development. Drawing upon psychological theories of social identity and cognitive processing, we illustrate how software developers’ self-defined social identities affect their approaches to development. We also point to behaviours that might indicate areas of increased risk of project delays or failure. Professional freelance software developers together with current computer science students addressed considerations of risk and security during development. A thematic analysis extracted three core themes of responsibility, risk, and optimism. We show how language used about responsibility for code security is framed through concepts of diffusion, displacement, and acceptance of responsibility. We also examine the way developers orientate to risk awareness, appetites for risk, and risk mitigation strategies. Examples of unrealistic optimism biases are highlighted and discussed. We discuss our findings in relation to psychological theories of responsibility, decision making and heuristics and biases, alongside prior work within software engineering. We conclude with a discussion of the advantages of using a psychological lens to examine the rationalisations and trade-offs made by developers when working with security in software.