I've been writing about the same handful of mistakes for over a year now, and I think it's worth stepping back to notice something other than the incidents themselves: how the founders and builders I actually talk to have changed, or haven't, over that stretch.
What hasn't changed much
The mistakes themselves are remarkably consistent. Missing database access rules, exposed keys, unguarded admin routes still account for nearly everything I write about, whether the story is from January or from last week. The tools have improved. The specific gap that keeps causing real incidents hasn't moved much at all.
What I have actually noticed shift
More people ask a specific question before launching now than did a year ago: "is there anything I should check before this goes live." That's a small, almost boring-sounding shift, and I think it's the actual leading indicator worth paying attention to, more than any single incident or any single tool release. A year ago, that question rarely came up unprompted. Now it's common enough that I've stopped being surprised by it.
Why I think this particular shift matters more than it sounds like it should
Nearly every incident I've covered traces back to a check that existed and simply never got run, not to a mistake so subtle that nobody could have caught it. The single highest-leverage change available to any individual builder isn't a better tool or a bigger budget. It's the habit of asking the question at all, before launch rather than after something goes wrong. A founder who's internalized "I should check this" as a normal part of shipping, even if they don't yet know exactly what to check, is already most of the way to catching the mistakes that keep making headlines.
What still hasn't caught up
Asking the question is one thing. Knowing what a good answer actually looks like is a separate skill, and that part is still inconsistent. I still talk to plenty of founders who've correctly identified that they should check something, and then accept a vague, confidence-only answer as sufficient, because they don't yet know what a specific, verifiable answer is supposed to sound like. The instinct to ask has spread faster than the ability to evaluate the answer.
What I'd actually want to see more of
Not more fear. The goal was never to make anyone anxious about tools that are, genuinely, remarkable. It's for the question "what should I check before this goes live" to become as automatic as "does the feature actually work," and for the answer to be something specific and testable, not just a feeling of confidence. A year in, the first half of that shift is clearly happening. The second half still has real room to grow.