Engineering notes, project retrospectives, and opinions on building software that lasts.
Most custom platforms get authentication right and skip authorization entirely. One unprotected endpoint and sequential record IDs are enough to expose every record in your system.