I don't think that the development itself is so much of a problem if done alone, offline and with proper disc encryption and if the software never gets distributed.
But, if you need help in development you need to communicate with others or at least get information from the internet. It might for example be that the developer forums you visit are compromised and use of these forums will compromise your system too, like in Apple, Facebook employees hacked via website malware, Java vulnerability or in FBI using an exploit to attack Tor users.
Even if not compromised the forums might log your visits, store the questions you've asked and the posts you've visited etc, which might be used to construct a picture of what you are working on and might later be used as evidence against you. And just visiting such sites via Tor does not make you fully anonymous - all what it does is hiding your IP address.
And then you likely need to somehow distribute the software to others. If done as binary for easy install then these binaries often include traces from the developer environment and process, like language used on the system, time the software was compiled, specific versions of software libraries used in your code, software versions used for compilation, debug information, ... . While none of this by itself will make it possible to find you and can help to narrow down the potential suspects and might later be used as evidence. Distributing as source code might even be worse since it can be more easily aligned with code snippets you might have asked about on the internet.
Also, I hope that would not blindly install arbitrary software you'll find on the internet and this kind of security you should expect from others too. So you somehow need to establish some reputation so that others will trust that the software does what it claims and does no harm. Building such reputation commonly involves that you need to communicate with others and trust others too - which makes your vulnerable if there is somebody you should not actually trust. For example government agencies are regularly able to infiltrate closed forums in the dark net even though the administrators of such forums try very hard to screen new members.
In summary: it is far from trivial and there is no simple tutorial to follow. The threat model is specific for where you live, what kind of software you develop, what your developments tools are, how do you want to distribute the software, how hard somebody would try to find you ...
