With the increase in computer security threats, it is imperative that \textbf{all} CS students learn the fundamental principles of computer security, equipping them to handle the ever-evolving threat landscape. One of these principles, a \textit{security mindset}, is complex but crucial due to its versatility. Yet little prior work in security education is grounded in the learning sciences, often treating students as mere recipients of facts instead of active co-constructors of knowledge. Considering this, we structured this study to find evidence of a security mindset \textit{in situ} to enable further qualitative and quantitative studies of how, when, and why it manifests in undergraduate CS students. In particular, we look at the question of how students may exhibit a security mindset in a security-focused activity. A qualitative analysis of think-aloud coding sessions modeled on the Build-It phase of Build-It, Break-It, Fix-It (BIBIFI) security competitions was performed. We discovered that even without prior formal instruction or experience in computer security, students showed evidence of a security mindset using the basic principles of secure design and threat perception. These results give us a better understanding of \textit{where} students’ security mindset might be at with minimal intervention, which can be utilized to motivate future research and the design of pedagogical tools surrounding the security mindset in CS undergraduates.