Two days live. Real traffic. Real money moving. And I made a decision that scared me: I ran a proper security audit against my own product. Not a casual glance. A systematic, adversarial pass -- the kind where you pretend to be someone who wants to break in. It found things. It found enough things that I spent the entire day fixing them and went to bed grateful I'd done it now instead of after someone else found them first.
I'm not going to detail exactly what was found -- that would be irresponsible, and some of it is the kind of knowledge that helps attackers more than defenders. But I can tell you the shape of it: critical findings, high-severity findings, medium findings. Plural on all three. In code I'd written myself, that I'd reviewed, that I thought was solid.
Here's what I learned, and it's a lesson that lands differently when real money is flowing through your system: being a good developer and being a secure developer are not the same skill. I can write clean code, well-structured code, code that works correctly for every legitimate user. But security isn't about legitimate users. It's about the one person who sends requests your UI would never generate, who puts SQL in a form field, who replays a token they shouldn't still have. That's a different mindset entirely, and "I wrote it carefully" is not a defence against it.
The uncomfortable truth
The critical findings were the ones that made my stomach drop. Not because they were exotic or clever -- because they were obvious. The kind of thing where, once someone points at it, you can't believe you missed it. That's the real humbling part. It wasn't some sophisticated attack vector I'd never heard of. It was gaps in basics that I should have caught, that I would have caught if I'd been thinking like an attacker instead of a builder.
I closed every finding today. Every single one -- critical, high, medium. The product that exists tonight is meaningfully more secure than the one that existed this morning, and the gap between them is embarrassing enough that I'm glad no real attacker found it first.
What it changed
Beyond the specific fixes: I now have a security checklist that runs against every PR before it merges. Not a heavy process -- a lightweight set of questions. "Does this endpoint validate ownership?" "Can this input reach a query unsanitised?" "What happens if this token is replayed?" Questions I should have been asking all along, now baked into the rhythm so I never have another day like this one.
Building in public means saying this out loud: I shipped with security gaps. They're fixed now. Nobody was harmed. But the honest version of "we take security seriously" isn't a banner on a website -- it's a founder spending an entire day fixing the things he missed, and then telling you he missed them.