I hear this one constantly, usually from someone who built something small on the side, for a handful of friends or a tiny customer base. "It's fine, nobody even knows this exists, why would anyone bother." It's a reasonable-sounding thought. It's also based on a picture of how these things get found that isn't accurate anymore, and hasn't been for a long time.
Nobody is looking at your app specifically
That part is actually true, and it's exactly why the myth is misleading. Almost nobody who finds a vulnerable app got there by deciding to target it. What actually happens is automated: scripts that continuously scan huge blocks of the internet, checking every reachable address for a handful of common, cheap-to-check problems. An exposed .env file at a predictable path. A database endpoint that responds to a generic request with no auth. A login form with no rate limit. These scans don't know or care what your app does, how many users it has, or whether you consider it a real project. They check everything, because checking is nearly free at scale.
Small and unknown just means fewer people looking on purpose
There's a real distinction worth making here. A five-user internal tool is genuinely less likely to be deliberately, manually targeted by someone with a specific reason to care about your business. That part of the myth holds up. But deliberate targeting was never the main way small apps get hit. The automated sweep doesn't distinguish between a five-user tool and a five-million-user product. If your app is reachable on the public internet, it's already inside the set of things being checked, whether you think of it as "launched" or not.
What actually gets found this way
The things automated scans catch are almost always the same handful of cheap, structural mistakes: a database with no access rules, a key sitting in plain text in the frontend bundle, a common file path (.env, .git/config, a debug route) that got left reachable. None of that requires anyone to know your app exists in any meaningful sense. It requires your app to have an IP address and respond to requests, which is true of literally everything online.
What this actually means for a small project
It doesn't mean panic, and it doesn't mean a five-user internal tool needs the same posture as a bank. It means the size of your user base is the wrong variable to reason from. The right question isn't "how many people would care about this." It's "what does this app expose to anyone who happens to check," because the checking is automated, constant, and indifferent to how important your project feels to you.
The good news is the fix is proportional to the problem. These are the same handful of cheap checks either way: is the database locked down, are there keys sitting in the open, are the obvious file paths closed off. A small project takes an hour to check. A big one takes longer, but it's the same list, just applied earlier than you'd otherwise think to bother.