What goes wrong repeatedly.
TRUSTING THE CLIENT
Prices, quantities, identifiers and permissions taken from the request.
AUTHENTICATION WITHOUT AUTHORISATION
The commonest serious vulnerability.
QUERIES IN LOOPS
The commonest performance fault.
NO TIMEOUTS ON EXTERNAL CALLS
One slow dependency exhausting capacity.
NO LIMITS
On request size, uploads, result sets or concurrency.
SECRETS IN THE REPOSITORY
Permanent once committed.
DEBUG ENABLED IN PRODUCTION
Exposing paths, versions and configuration.
NO BACKUPS, OR UNTESTED ONES
Discovered at the worst possible moment.
MIGRATIONS THAT LOCK LARGE TABLES
Fine in development, an outage in production.
WORKERS NOT RESTARTED AFTER DEPLOYMENT
Old code running indefinitely.
SCHEDULED JOBS WITH NO ALERTING
Failing silently for months.
LOGGING SENSITIVE DATA
Discovered during an audit.
WHAT PREVENTS MOST OF THESE
Validation, authorisation checks, timeouts, limits, and testing what you assume works.
