One month in on this second run of topics, and the same rule from January still holds: none of this is exotic, it's just easy to skip while you're moving fast. Here's February compressed onto one page.
Features that need their own specific check
- File uploads: check real content type, not just the extension. Enforce size limits server-side. Never build a file path from a raw filename.
- Webhooks: test whether your endpoint verifies a real signature, or accepts a request from anyone who finds the URL.
- AI chat or agent features: treat anything the assistant reads from outside content as untrusted data, not as instructions, and gate any real action behind a confirmation step.
- Session cookies: check HttpOnly, Secure, and SameSite are actually set, not left at their defaults.
Myths worth retiring
- "Nobody's reported a problem" does not mean there isn't one. Most exposures are silent until someone specifically looks.
- "It's encrypted" answers a completely different question than "who can read it." Encryption at rest protects against stolen storage, not a logged-in request asking for the wrong row.
Questions worth asking before you spend money
- A freelance contract should say, in writing, whether a security pass is included in the build or billed separately, and who owns testing for cross-account data leaks specifically.
- A two-person startup almost never needs SOC 2 yet. The practices underneath it, access control, an incident plan, basic monitoring, are worth adopting long before the certificate is.
- A monitoring subscription and a one-time deep audit solve different problems. One catches regressions over time. The other catches your business logic being wrong in a way no scanner has a pattern for. Neither replaces the other.
What actually happened this month
An AI-agent social network called Moltbook launched and had its database exposed within days, the same missing row-level-security pattern that's caused nearly every story like this for a year. A researcher disclosed 16 vulnerabilities in a Lovable-built exam and grading app used across UC Berkeley, UC Davis, and K-12 schools, after a quiet report to the platform reportedly went nowhere. Cursor shipped an agent that can automatically test and patch security findings, which is real progress and a new question about how carefully those automated fixes get reviewed.
The one thing worth remembering
Every incident above traces back to something on a checklist that already existed before it happened. The gap was never a missing tool. It was a check that existed and didn't get run, on an app that was moving fast enough that running it felt optional right up until it wasn't.