Midweek honesty: most breaches are not genius. They are a default password, an old account nobody switched off, and a team too busy to check.

Question: does your team have a written plan for "we have been hacked", or would you figure it out on the day?

Myth: "We use HTTPS, so we are secure." HTTPS protects the road. It does nothing about who you let into the house.

Founder checklist #5: you have tested what a logged-in user can do to another user's data. Not just what a stranger can do.

Refunds, reversals and chargebacks get less testing than checkout. Fraudsters know this. If your refund can be triggered twice, it eventually will be.

Danfo rule for security: if everybody can enter through the back door, the conductor collecting money at the front is just for show.

Plain words: "least privilege" means each person and each system gets only the access it needs to do its job. Nothing extra "just in case".

Logs you never look at are just storage costs. Pick one alert that matters (new admin created, MFA disabled, big export) and actually send it to someone's phone.

Morning nudge: log out of accounts on devices you no longer use. Old phones and shared laptops remember more than you think.

Security work is mostly asking calm questions about things everyone assumed were fine. That is a skill anyone can learn.

When did @opay start failing transactions 😭😭

Security is not the team that says no. It is the team that tells you which yes will hurt later.

Question: when your app sends an OTP, how long does it stay valid? If you do not know, find out tomorrow.

Question for builders: what is the one part of your app you would least like a stranger to test? That is probably the part to test first.

Founder checklist #4: your production keys are not in your code repository, including the old commits.

Payment webhooks: verify the signature, check the amount against your own records, and make the handler safe to run twice. Skip any one of these and someone eventually gets something for free.

Every security person has heard it: "We have antivirus, so we are fine." Antivirus does not stop your intern from sharing the admin password.

Plain words: "IDOR" means you can see someone else's data just by changing an ID in the request. Simple to find, simple to fix, still everywhere.

Rotate one secret today. Just one. The API key from 2024 that three former interns had access to is a good place to start.

Morning nudge: if you reuse one password across accounts, a password manager is the best free upgrade you can make this week.