A question worth asking honestly about your own app: if something broke right now, an error started firing on every request, a service went down, unusual traffic started hitting an endpoint, would you actually find out, or would the first sign be a user complaining, or worse, someone else's public writeup?
Why most small apps have zero visibility into this
Building the feature is the whole job when you're moving fast, and watching what happens to it afterward feels like a separate, later concern. Most apps I look at have no error tracking, no uptime monitoring, and no alerting at all. Everything runs quietly until either a user notices something's wrong and says so, or nobody notices for a long time, which is exactly the gap that turns a small, catchable problem into a much bigger one before anyone's aware it exists.
The two free things worth setting up today
Error tracking
A free-tier error tracking tool, several of the well-known ones offer a generous free plan, catches unhandled errors in your app and sends you a notification, with the actual stack trace, instead of a user simply seeing something break and giving up without telling you. Setup for most frameworks is a handful of lines: install the package, add your project key, deploy. Twenty minutes, and suddenly you know about problems the moment they happen instead of whenever someone bothers to mention it.
Uptime monitoring
A free uptime checker pings your app on a schedule, every few minutes, and alerts you the moment it stops responding. This catches the case where your app isn't just erroring, it's fully down, and nobody's watching. Also a five to ten minute setup, and it means you find out from a text message instead of from a customer.
Why this matters for security specifically, not just uptime
A sudden spike in errors on a login endpoint can be an early sign of someone running a script against it, trying passwords at scale. A spike in traffic to a specific API route, one nobody's actively driving from your own frontend, can be a sign someone found it and is probing it directly. None of this requires a dedicated security monitoring product to notice, if basic error and uptime tracking is already in place. Without it, the same activity is completely invisible until it's already caused real damage.
What to actually do with the alerts
- Don't just install it and forget it. Actually look at what comes through for the first week, so you know what normal looks like.
- Set alerts to somewhere you'll actually see promptly, not an email address you check once a week.
- When something unusual shows up, a spike, an unfamiliar error, take five minutes to look at it rather than dismissing it as noise. Most of the time it is noise. Occasionally it's the first sign of exactly the kind of thing this whole blog is about.
None of this replaces the access-control checks that have been the core of everything I've written this year. It just means that if something does slip through, you find out while it's still small, instead of finding out from someone else, much later, after it wasn't.