Security Isn't a Feature You Add Later
Security treated as a checklist item at the end of a project is both expensive and incomplete — expensive because retrofitting proper authentication or input validation into an already-built system means touching code that was never designed for it, and incomplete because the deepest vulnerabilities usually come from assumptions baked into the original architecture, not surface-level bugs a late review would catch.
In practice, that means a few things aren't optional, even on a first version: passwords hashed with a modern algorithm like Argon2id or bcrypt rather than anything weaker, every form protected against CSRF, every database query using prepared statements rather than string concatenation, and login attempts rate-limited so brute-forcing a password isn't just slow, it's actively blocked. None of this is exotic — it's well-established practice — but it has to be in the code from the first commit, not scheduled as a follow-up task that competes with new features for priority later.
The same logic applies to file uploads, one of the most common real-world attack surfaces: validating actual file content rather than trusting a filename extension, generating random storage names instead of using whatever a user uploaded, and keeping uploaded files outside anywhere they could be executed as code.
None of this guarantees a system is unbreakable — nothing does. But the difference between a system that was built with security as a first-class concern and one where it was added under pressure after the fact is usually very visible to anyone who actually looks.
In practice, that means a few things aren't optional, even on a first version: passwords hashed with a modern algorithm like Argon2id or bcrypt rather than anything weaker, every form protected against CSRF, every database query using prepared statements rather than string concatenation, and login attempts rate-limited so brute-forcing a password isn't just slow, it's actively blocked. None of this is exotic — it's well-established practice — but it has to be in the code from the first commit, not scheduled as a follow-up task that competes with new features for priority later.
The same logic applies to file uploads, one of the most common real-world attack surfaces: validating actual file content rather than trusting a filename extension, generating random storage names instead of using whatever a user uploaded, and keeping uploaded files outside anywhere they could be executed as code.
None of this guarantees a system is unbreakable — nothing does. But the difference between a system that was built with security as a first-class concern and one where it was added under pressure after the fact is usually very visible to anyone who actually looks.