Any permission that has
.code in it means the permission of the smart contract on the account. So in the case of
eosio.code, it gives permission for the contract to use functions from the
eosio smart contract. You could equally have permissions like
mycontract.code, which would say that a contract had permission to use whatever actions are linked to that permission.
You don't need to add anything specific to the source code in order for the permissions on the contract to be valid, but rather you need to make sure you have valid permissions given certain code. For example, you need
eosio.code permission in order to do EOS transfers within your contract.
There is a compromise in security every time you add a permission to an account or smart contract. An incorrectly formed contract with this permission could potentially allow someone to transfer funds that they shouldn't transfer.