Although it is widely accepted that security in software should never be an afterthought, in many cases, it is. Particularly in the context of legacy codebases, security considerations often take a backseat, pushed back by the pressing demands of functionality, maintenance, and tight development timelines. The very important topic of security is often sidelined or bolted on during the later stages of development, leading to vulnerabilities that could have been avoided with a more proactive approach. Addressing this challenge requires a focus on redesigning legacy code with security as a central concern. This thesis explores the impact of Secure by Design principles, specifically domain primitives, on enhancing software security through a study involving the OWASP(Open Web Application Security Project) Juice Shop, an intentionally insecure web application. The application undergoes a partial redesign where domain primitives are implemented into the legacy code, after which the inbuilt challenge system is used to evaluate the two versions. The redesign of the application employs the Secure by Design principles as detailed by Deogun et al.(2019), aiming to showcase the practical benefits and effectiveness of adopting proactive secure design strategies. The experiment yielded good results that showed the potential of implementing domain primitives into legacy code. However it is clear that it must be accompanied by other security measures to achieve an application that is truly secure by design.