Skip to content
injuid

Inspection report

Eleven things a weekend build will not tell you.

A plain list of what goes wrong when software gets built without someone who knows infrastructure. None of it is exotic. All of it is common. Every item has ended a small company, and every one of them is checked for, on purpose, in every injuid build. Open a finding to see what it looks like, what it costs, and the check.

Subject
Software built without infrastructure experience
Findings
11 open
Critical
5 end the business
Read time
About eight minutes

  1. What it looks like
    The app talks to a payment provider, an email service, or a database. To make it work, the key was pasted into the front end code. Anyone who opens dev tools can read it.
    What it costs
    Someone uses your key to send spam through your account, drain your API credit, or read your data. You find out when the bill arrives or the provider suspends you.
    The check
    Every secret lives on the server, in an environment variable, and is never sent to the browser. We grep the built bundle for anything that looks like a key before launch.

  2. What it looks like
    The database has security rules, but they were left at the default so development would be quicker. Any logged-in customer can read every other customer's records by changing an ID in a request.
    What it costs
    A curious customer, or a competitor with a free account, exports your whole customer list. Under the Notifiable Data Breaches scheme you have to tell every one of them.
    The check
    Access rules are written and tested as part of the build. We log in as two different customers and try to read each other's data before anyone else does.

  3. What it looks like
    Login was built from scratch. Passwords are hashed with something that looked fine, reset links never expire, sessions never time out, and there is no rate limit on the login form.
    What it costs
    Accounts get taken over. If the passwords leak, your customers' other accounts are at risk too, because people reuse them.
    The check
    We use an established identity provider and the platform's own session handling. Login is boring on purpose.

  4. What it looks like
    Every client's data lives in the same tables with a customer ID column. The only thing keeping one client out of another's records is a where clause that every developer has to remember, every time.
    What it costs
    One forgotten filter and client A sees client B's invoices. It gets found by a client, not by you.
    The check
    Tenancy is enforced at the database layer, not the application layer, so a forgotten filter returns nothing instead of everything.

  5. What it looks like
    Nightly backups are ticked on in the hosting console. Nobody has ever downloaded one and tried to bring the system back from it.
    What it costs
    The day you need it, the backup is empty, encrypted with a key nobody has, or restores to a version from eight months ago. A backup that has never been restored is not a backup, it is a hope.
    The check
    Restores are tested on a schedule and the result is written down. The monthly plan includes it because nobody does it otherwise.

  6. What it looks like
    The hosting provider defaulted to a US region and nobody changed it. Health, legal, government, or finance customers have obligations about where their data lives.
    What it costs
    It gets discovered during a tender or a security questionnaire, at which point you either lose the deal or fund a migration under time pressure.
    The check
    Region is a decision made in scoping, written into the spec, and checked at launch. Australian data stays in Australia unless there is a reason for it not to.

  7. What it looks like
    It was faster to set it up on the developer's own account. The domain renewal, the hosting bill, and the DNS login all go to a person, not the business.
    What it costs
    The developer moves on, their card expires, or the relationship sours. The site goes dark and recovering it involves lawyers, or it never comes back at all.
    The check
    Every account is created in the business's name, on the business's card, with the owner as the primary contact. injuid gets delegated access, never ownership.

  8. What it looks like
    The app was built on a few hundred open source packages, which is normal. Nobody is watching them. A vulnerability announced in one of them sits in production for a year because nobody's job is to look.
    What it costs
    Known, published, automated exploits. This is the category of breach where the attacker did not have to be clever.
    The check
    Automated vulnerability alerts, a monthly patch window, and someone whose job it is to read the alerts. That is most of what the monthly plan is.

  9. What it looks like
    Pay-per-use hosting is cheap until a function calls itself, a cron job runs every minute instead of every day, or a bot hits an unprotected endpoint ten million times.
    What it costs
    A hosting bill with an extra zero, or two, before anyone notices. Some providers will waive it once. Some will not.
    The check
    Spend alerts and hard limits on every account from day one. Rate limits on every public endpoint. Both are cheap, and both get skipped when speed is the only goal.

  10. What it looks like
    Something went wrong for a customer on Tuesday. There is no record of what they did, what the system did, or what failed. The only evidence is their description of it.
    What it costs
    Bugs that cannot be reproduced do not get fixed. Security incidents cannot be investigated. When the regulator asks what data was accessed, the honest answer is that you do not know.
    The check
    Structured logs, error tracking, and uptime monitoring from the first deploy. Not a dashboard for its own sake. Enough to answer the question: what happened.

  11. What it looks like
    The system runs on things only one person knows. Which server, which password, why that cron job exists, what happens if you turn it off.
    What it costs
    That person is on leave, sick, or gone, and the business is stuck. Every future developer starts by reverse engineering the last one.
    The check
    A written runbook is a deliverable, not an afterthought. Where everything is, how to get in, how to restore, who to call. You get it at handover and it is kept current under the plan.

12, Obligation

Whose problem is it.

Under Australia's Notifiable Data Breaches scheme, when personal information is lost or exposed and is likely to cause serious harm, the organisation that holds the data has to notify the people affected and the Office of the Australian Information Commissioner.

The organisation. Not the developer who built it, and not the tool that generated the code. The business owner carries the obligation, and in practice carries the cost of the notification, the response, and the reputation.

None of the items above need a genius to avoid. They need someone who has seen them go wrong before and checks for them on purpose. That is what you are paying for when you pay for experience.

How a Build avoids themAsk about a system you already have