Six weeks into the year feels like a strange time to check in, too soon for a real retrospective, too far in to call it fresh. But I've been looking back at what I've actually written about since January, and the pattern is worth naming out loud rather than waiting for a bigger, tidier moment.
Nothing new. That's the finding.
I haven't come across a genuinely new category of mistake this year. Every post I've written since January traces back to a handful of the same root causes: a database access rule that wasn't turned on, a key that ended up somewhere the browser could read it, an API route that trusted a request more than it should have, an agent given more standing access than the moment called for. None of that is new information. It was all true in 2025 too.
What has changed is the volume
What's different is how many people are hitting these same mistakes now, simply because more people are building real, live, database-backed software than were six months ago. The tools didn't get meaningfully less safe. The pool of people building with them, many with no security background and no reason to have one, got a lot bigger. A constant mistake rate applied to a growing number of builders looks, from where I'm sitting, like more incidents, even if the underlying tools are no more or less careful than they were.
Why I think this matters more than a new vulnerability class would
A genuinely novel attack technique would be interesting, but in a way it would also be less concerning, because novel techniques are rare and specific. What I'm actually seeing is the opposite: extremely well-understood, well-documented mistakes, the exact same ones that caused headlines a year ago, showing up in fresh apps built this week, by people who in most cases have simply never been told to check for them. The problem isn't sophistication on either side. It's coverage. The checks that would catch nearly all of this are short, free, and still not part of most people's process.
What I'd tell someone building right now, six weeks in
Nothing dramatic. If you've built something this year, run through the same handful of checks that have shown up on this blog since January: can one account see another's data, does a logged-out request to an admin route actually get refused, is a key sitting somewhere the browser can read it, are your database's access rules actually turned on and correct, not just present. None of it is new advice. It's just advice that keeps mattering, at a volume that keeps growing, for exactly as long as building stays this fast and checking stays this optional.