"I'm not charging anyone for this, it's just a small side project, does any of this actually apply to me?" is a fair question, and one I'd rather answer honestly than with a blanket "yes, everything applies to everyone," because that's not quite true either.
The real question isn't money, it's data
Whether an app charges money isn't actually the deciding factor for how much a security gap matters. What matters is what the app holds and who it affects if that data gets out: email addresses, real names, anything personal, anything shared in confidence between users. A completely free tool that collects email addresses from a hundred sign-ups has real people's real data sitting in it, regardless of whether a single dollar has changed hands.
Where a truly low-stakes hobby project sits
A genuinely personal project, used only by you, or a small group of friends who all understand and accept it's an early experiment, holding nothing particularly sensitive, is legitimately lower stakes. Nobody's expecting professional-grade protection from a weekend project shared in a group chat, and treating every single side project with the same rigor as a customer-facing product would be a poor use of anyone's time.
Where it stops being genuinely low-stakes
- The moment strangers, not just people you personally know and who understand the context, start signing up.
- The moment it collects anything beyond a username: real email, real name, any personal detail at all.
- The moment people using it reasonably expect it to behave like a real product, even if it's free.
- The moment it's mentioned publicly, on social media or elsewhere, inviting people who have no relationship with you to try it.
A simple way to decide
If everyone using it personally knows you and understands it's an experiment, and it holds nothing sensitive, a full check is genuinely optional. The moment strangers are involved, or it collects anything real about a real person, the price tag stops being the relevant variable, and the same basic checks worth running on anything else become worth running here too.