"We're hosted on a major platform, they have a whole security team" comes up often enough that it's worth being precise about exactly what that security team's work actually covers, and what it doesn't touch at all.
What a major hosting platform's security team actually does
Companies like Vercel, AWS, and similar large infrastructure providers invest heavily, genuinely, in securing the infrastructure layer: the physical data centers, the network, the underlying systems that keep your app running and available, protection against large-scale infrastructure attacks. This is real, substantial security work, and it's a big part of why building on established infrastructure is a reasonable default rather than running your own servers from scratch.
What none of that touches
None of that infrastructure security has any opinion about whether your specific database's row-level security is configured correctly. None of it checks whether your specific admin route actually requires authentication. None of it verifies that your specific API correctly checks who's asking before returning data. Those are decisions made in your application's code and configuration, sitting on top of the infrastructure, and the platform's security team has no visibility into, or responsibility for, any of it.
A way to picture the actual boundary
Think of the platform as securing the building: the locks on the main entrance, the structural integrity, the fire suppression system. What happens inside your specific unit, whether you lock your own door, whether you leave a spare key under the mat, whether you've told your unit's system who's allowed in which room, is entirely up to you. A secure building doesn't make an unlocked apartment inside it secure, and a secure hosting platform doesn't make an app with a missing access rule secure either.
Where this misconception actually causes real damage
Nearly every incident I've written about this year happened on reputable, well-run infrastructure. The Lovable disclosure, the Base44 bug, the Moltbook exposure, none of these were infrastructure failures. Every one of them was a missing configuration or a coding decision made at the application layer, on top of infrastructure that was, by every account, functioning exactly as intended the entire time.
What's actually worth remembering
Choosing a reputable platform is a genuinely good decision, and it removes real risk from your plate at the infrastructure layer. It says nothing at all about whether your specific database rules, your specific keys, and your specific admin routes are configured correctly, because that layer was never the platform's job to secure in the first place. That part is still entirely yours, regardless of how impressive the infrastructure underneath it happens to be.