Another month, another page. Here's April compressed, the same way January through March got their own recaps.
Features that need their own specific check
- Background jobs and cron tasks: check what database access they hold and whether any manual trigger point has the same auth scrutiny as a normal route.
- Cookie consent banners: confirm decline actually stops tracking scripts from loading, not just that the banner visually disappears.
- Search features: confirm results are scoped to what the current user is actually allowed to see, tested with two separate accounts.
- Websocket and real-time connections: confirm joining a specific channel checks the user actually belongs to it, not just that they're logged in generally.
- JWT verification: confirm your server pins the expected signing algorithm and explicitly rejects the "none" algorithm.
Myths worth retiring
- "It's just a script tag" undersells how much access a third-party widget actually has to your page.
- A reputable hosting platform secures its own infrastructure. It has no opinion about your specific database rules or admin routes.
Questions worth asking before you need the answer
- What actually happens to your data if the platform you built on shuts down or changes hands overnight? Test your export path now, not during an emergency.
- Should you delay a launch for every finding, or ship with some accepted? Reserve hard stops for anything touching real user data or money specifically.
- Do you owe customers disclosure about a past, already-fixed incident? Proactive, factual disclosure tends to build more trust than silence that gets discovered later.
What actually happened this month
Two separate Lovable incidents became public in the same week: a chat-history and source-code exposure fixed within two hours, and a broken-object-level-authorization flaw, reported back in early March, still unpatched for older projects at the time of disclosure. Worth remembering these were genuinely different problems with different lessons, not one blurred story.
The one thing worth carrying forward
The apps I'm seeing now are more ambitious than the ones from January: real payments, multi-tenant setups, embedded AI features. The checklist hasn't gotten longer to match that ambition. It's the same handful of checks it's always been. What's changed is the cost of skipping them, and that cost keeps climbing right alongside everyone's confidence.