"We're tiny, only a couple hundred users, nobody's going to bother targeting us" is one of the more common things I hear from early-stage founders, and it's built on an assumption that turns out to be the wrong picture of how most of this actually happens.
The assumption baked into this myth
It pictures an attacker sitting down, deciding your app specifically is worth their time, weighing your size against the effort involved. That's a real thing that happens for high-value, specifically chosen targets. It's not how the vast majority of scanning and probing actually works, and it's not the scenario responsible for most of the incidents I've written about on this blog.
What actually finds small apps first
A huge amount of scanning across the internet is automated, running constantly, checking enormous numbers of sites for the same handful of common patterns: an exposed .env file, an open database, a predictable admin URL. These scanners don't know your app exists until they stumble onto it, and once they do, they don't care whether you have ten users or ten million. They're checking for a pattern, not evaluating a target's importance first.
Why size genuinely doesn't factor into it
An automated scanner checking a random range of addresses for exposed .env files doesn't slow down to assess how big or important the app behind that address is. If your database is open, it's just as open to that scanner as a much larger company's would be. The gap itself doesn't scale with your size, it's either there or it isn't, regardless of how many users you currently have.
Where size actually does matter
A small, early app has real user data too, even if there's less of it, and a breach still means real people's information got exposed, regardless of the count. Being small changes the scale of the fallout, not whether the gap gets found in the first place. And an app that starts small usually doesn't stay that way, whatever's true today compounds as it grows.
"Nobody would bother" assumes a level of deliberate targeting that mostly isn't how this works. The far more common story is an automated check finding a pattern it was built to find, with no awareness of, or interest in, how big the app behind it happens to be.