Three months of daily posts is a lot to hold in your head at once, so here's the whole quarter compressed onto one page. Bookmark this one specifically, it's meant to be the fast version of everything else.
The checks that matter most, regardless of what you're building
- Cross-account test: log into two separate accounts and try to reach one account's data from the other, on every feature, not just the obvious ones.
- Logged-out admin test: open a private window with no session and try every admin or internal route directly. It should refuse you completely.
- Key search: grep your repo and your deployed frontend bundle for anything that looks like a secret. Rotate anything that was ever exposed, don't just remove it.
- Database rules, checked directly: confirm row-level security or its equivalent is not just enabled, but actually correct, table by table.
- Rate limits on login, signup, password reset, and any paid API feature. An unlimited endpoint is an open invitation, not a theoretical risk.
Myths worth retiring for good
- "We use HTTPS" and "it's encrypted" both answer a completely different question than "who can read this."
- "Nobody's reported a problem" means nobody's told you, not that nothing's wrong.
- "It's just an internal tool" is not a security boundary. Your server doesn't know what "internal" means.
- Deleting or disabling a user in your admin panel doesn't automatically end their already-active session.
- A form only showing a few fields doesn't mean the endpoint behind it only accepts those fields.
What actually happened this quarter
Moltbook launched and had its database exposed within four days. A researcher disclosed 16 vulnerabilities in a Lovable-built exam app used across three university systems and K-12 schools, after a quiet report reportedly went nowhere. Base44's serious authentication bug, discovered weeks after its 80 million dollar acquisition, got patched in about a day once reported. GitGuardian's annual report showed leaked secrets up 34% year over year. None of these were new attack techniques. All of them trace back to a check that already existed and simply didn't get run.
What actually got better this quarter
Cursor shipped an agent that automatically tests and patches its own security findings. OpenAI launched Codex Security with real threat-modeling instead of pattern matching alone. Claude Code's deeper security capability moved into limited preview. The tools are visibly investing in this, faster than I expected when the year started.
The one thing worth carrying into the next quarter
Better tools help the person who reaches for them, or who's building on a platform that runs the check automatically without being asked. Every incident this quarter happened to someone who, as far as the public record shows, never had a check run before launch. The gap isn't a lack of available help. It's whether the help gets used before real user data is on the line, not after.