Most days I pick one topic and go deep. Today I want to try something different: a handful of smaller questions people have actually asked me recently, each worth a real answer, none quite big enough to justify its own full post on its own.
"Do I need to worry about this on a completely free, no-signup tool?"
Less than an app with real accounts, but not zero. Even a tool with no login can leak something through a misconfigured API, an exposed key, or a form that stores submissions somewhere. The stakes scale with what data actually flows through it, not with whether there's a login screen.
"How often should I actually re-run the basic checklist?"
Ideally every time you ship something that touches auth, data access, or a new integration, not on a fixed calendar. If nothing's changed in those areas, a monthly glance is reasonable. If you just shipped a new feature touching any of them, that's the actual trigger, not the date.
"Is it worth learning basic security concepts myself, or should I always hire this out?"
Worth learning the checklist-level basics regardless, the same way it's worth knowing how to read a lease even if you'd hire a lawyer for something complex. Understanding what a real answer to "is this secure" sounds like is useful whether you're checking it yourself or evaluating someone else's answer.
"What's the single most common mistake you actually see?"
Missing or incorrect row-level security, by a wide margin. It's the root cause behind most of the major incidents I've covered this year, across nearly every platform, and it's the first thing I check on any app someone shows me.
"Should I be worried about AI models themselves being a security risk, separate from the code they write?"
Mostly a different category than what this blog covers. The risk I write about is overwhelmingly about the code and configuration an AI tool produces, not about the model's own behavior in some abstract sense. The supply-chain risk I wrote about with Amazon Q is the closest thing to this concern actually being realistic, and it's about the tool's own pipeline being compromised, not the model reasoning its way into malice.
"Is there a shortcut version of everything you've written this year?"
The quarterly recaps, January's and April's, are close to it. If you only ever read two posts from this whole blog, those are the ones I'd point to.
That's the batch for today. If you've got a question that didn't fit a full post either, it's worth asking anyway, the small ones add up to exactly the kind of basic literacy that prevents most of what ends up on this blog in the first place.