I talk to a lot of people about apps they've built, and there's a specific pattern in what gets asked, and what almost never does, that I keep noticing enough to write down.
The question everyone asks
"Does it work?" in some form is the universal question. Does the signup flow complete. Does the dashboard load the right numbers. Does the payment go through. That's the right first question, and it's the one AI coding tools are extremely good at helping answer quickly, because functional correctness is exactly the kind of thing you can see and click through and confirm.
The question almost nobody leads with
"Who else can see this, and have I actually checked?" This is a completely different question from whether the feature works, and it's the one that determines whether an incident happens. Nearly every story on this blog started as an app that worked perfectly by the first measure. The gap was never functional. It was that nobody asked, or tested, the second question before real users showed up.
Why the imbalance makes sense, even though it's costly
Testing whether something works is immediate and satisfying: click it, see the right result, feel done. Testing whether something is properly restricted requires actively trying to misuse your own work, a different mental posture that doesn't come naturally right after building something and feeling good about it. Nobody skips this question out of carelessness. They skip it because the first question has an obvious, built-in moment where you naturally check it, and the second one doesn't, unless you deliberately create that moment yourself.
What I actually wish happened more
Not more fear, and not a longer list of things to worry about. Just the habit of asking the second question in the same breath as the first, as a matched pair rather than an afterthought: does it work, and who else can reach it. That reframing alone, without any new tool or any new expertise, would have prevented most of the incidents I've written about this year, because the fix, once you know to ask, is usually a single setting or a single missing check away.
If there's one habit worth taking from a year of these posts, it's this pairing. Not a longer checklist to memorize. Just a second question that rides along with the first one, every time, until asking it stops feeling like extra work and starts feeling like part of what "finished" actually means.