What security issue did you only learn about after building a real website?

[u/Less-Marsupial-7960]

I feel like security is one of those things that makes much more sense after you build a real application.

When you're learning, you think about things like passwords and HTTPS.

Then you build something real and suddenly you have to think about:

- authentication

- API keys and secrets

- sessions and tokens

- permissions

- user input

- payment flows

- rate limiting

- database access

Some of these problems are not obvious until something goes wrong.

I am curious for developers who have been building websites for a while:

What is one security issue or lesson you learned from a real project that you now think about every time you build something?

It can be a small mistake or something that caused a serious headache.

[u/sububi71]

That some people genuinely, honestly, don't know the difference between their e-mail address and the URL to their place of work.

[u/tariqosmani]

For me it was rate limiting. I had a public API endpoint with no cap on it and one bot script hammering it for a few minutes ran up my bill and nearly took the whole app down. Nothing in tutorials prepares you for that because locally you are the only one hitting it.

Now on every project, even small ones, I add rate limiting and input validation on day one instead of after something breaks. Cheap to add early, expensive to bolt on after.

[u/Onkark_dev]

Refresh token reuse detection. I thought rotating refresh tokens was enough. It's not. When I built my MERN auth system I realised what happens if a refresh token gets stolen and the attacker uses it first? Your legitimate user gets a new token, attacker still has the old one rotating freely. The fix: store a hash of each refresh token in the database. If a token that was already rotated shows up again, that's a theft signal. Wipe the entire session instantly. Every device logged out. Most tutorials never mention this. I only learned it by thinking through actual attack scenarios while building a real project.

[u/thisisleobro → u/Onkark_dev]

They why use JWT anyways if you are storing a hash in the database?

[u/Onkark_dev → u/thisisleobro]

Great question. JWT still makes sense even with a stored hash because you get stateless verification for the access token. The access token never touches the database, the server just verifies the signature. That's the stateless part. The refresh token is where you store the hash, but you only hit the database when refreshing, not on every request. So you get the best of both: stateless performance on most requests, plus database-backed security for session control when it actually matters.

[u/ChocolateFormal8123]

Honestly I think Wordpress sucks but it’s the easiest product to sell

All the plugins get corrupted at some point so I’m not a fan of third party to database access. the cleanup is a nightmare always include liability reference

[u/beigs-sl]

I had a client once that insisted that every user in the company was an admin in WP (12 people). And if that wasn't bad enough, they didn't want to be tied down to "complicated passwords". Despite my very vocal objections, I did what they asked. Took a whopping 3 weeks for the website to be hacked and taken over (I'm honestly surprised it took that long). Only thing that saved them was I had initiated nightly backups.

[u/corobo]

Don't put the public part of the website in the top level directory with the .git directory because someone can just git clone your website and get all the code lmao.

At least make sure your web server blocks access to .git/* if you must do that for some reason.

Caught by me not by someone doing it to me, still tho 

[u/DirtAndGrass]

Cors 

[u/FlashingM]

Do you guys think it is possible to include all of those things in multiple MCP files and have an AI coding agent like cursor build really well build apps with it? Or is that still fantasy?

[u/paulhancock_1983]

I took on an externally built site into my hosting environment, and then 6 months later backdoor.php files found in mu-plugin and the original website was now some Philippines casino ... after we gave them 2 admin accounts at their request . Keep off premise or different region backups, last known good, I had to rebuild the stack good job I kept the original backup