Security Isn't a Feature: The Basics Every Web App Needs
Security is not something you bolt onto a finished product. It is a property of how the whole thing is built, from the first decision to the last. And most breaches do not come from brilliant attackers finding an exotic flaw — they come from ordinary basics that were quietly skipped.
Here are the fundamentals that stop the overwhelming majority of attacks, and why they matter as much for a small business as a large one.
Security is a property, not a bolt-on
The most expensive mistake is treating security as a phase near the end — a box ticked before launch. By then, the decisions that matter most have already been made.
Built in from the start, security is mostly a set of good habits. Retrofitted at the end, it is a scramble that never quite covers everything.
The basics that catch most attacks
A handful of fundamentals do most of the work. Validate everything a user sends you. Handle authentication properly. Serve everything over HTTPS. Keep dependencies patched. And give every part of the system the least access it needs to do its job.
None of this is glamorous, and all of it is what actually keeps a system safe. The exotic attacks make the news; the boring basics prevent the breaches.
Where it usually goes wrong
The common failures are depressingly predictable. An out-of-date dependency with a known hole. Access control that trusts the front end to enforce the rules. Sensitive data logged or exposed where it should never be.
Each is avoidable, and each shows up again and again in real incidents. The pattern is rarely sophistication — it is something ordinary left undone.
Small businesses are targets too
It is tempting to assume attackers only bother with big names. In reality, most attacks are automated and indiscriminate — bots scanning the whole web for known weaknesses, not caring whether you are a household name or a local firm.
That means a small business with the basics skipped is often an easier target than a large one that got them right. Size is no protection.
Getting it right
Good security is unglamorous, continuous and built in: sensible defaults, dependencies kept current, and access locked down by design. It is closely tied to keeping systems maintained, and to modern login approaches like passkeys.
If you are building something that will handle real customer data — or you are not sure how exposed an existing system is — we can help. Contact us and we will make sure the basics are genuinely covered.