Nobody Was Reading Your Code Before. Now Something Is.
Security was a Series B problem because attacker attention was scarce and expensive. A model that finds and exploits unknown flaws on its own ends that assumption
Every founder I've met with an MVP and 200 users has made the same bet, usually without noticing they made it. The bet is that nobody cares enough to attack them yet. It was a good bet. Finding a real vulnerability in custom code takes a skilled human several hours, and skilled humans doing that work have better targets than your beta.
That bet is now priced wrong.
OpenAI said this week that its upcoming model, Astra, is the first to cross its "Critical" cybersecurity capability threshold, meaning it can find previously unknown security flaws and exploit them without step-by-step human guidance. OpenAI says it will restrict access to those capabilities. I believe them, and it doesn't matter. The interesting fact isn't that one lab shipped one model. It's that the capability exists and has been demonstrated, which means the cost of auditing arbitrary code just fell toward zero, permanently, for everyone including the people who will eventually run an open-weights version of this on a rented GPU.
I haven't touched Astra. I don't need to. I've spent enough years on the other side of this to know what happens when the marginal cost of attacker attention drops: targeting stops being selective. Nobody chooses you. Something scans everything, and you're in "everything."
What security reviews actually caught
When I was CTO of a product at 10M monthly active users with 35+ engineers, we ran access and security reviews on a schedule. I expected to find clever things. We almost never did.
What we found, over and over, was boring. An admin endpoint that checked whether you were logged in but not whether you were an admin. A file upload that trusted the filename the browser sent. A password reset token that didn't expire. A staging environment with production data and a shared password in a Slack thread from 2019.
Not one of those required a genius to find. They required someone to look. At 10M users we had enough attention pointed at us that we had to be the ones looking first. At 200 users, nobody was looking, and that is the entire reason "we'll harden it later" ever worked.
Here's the part that should bother you if you're paying an agency right now: those same five categories are exactly what gets hand-rolled on a three-week build. Auth, payments, file uploads, admin access, and environment secrets. They are the corners a contractor cuts to save two days, and they are the only corners a code-reading model needs to check.
The decision, not the technology
You can't read your codebase. Fine. You don't need to. You need to ask four questions in your next call with whoever is building your product, and you need to hear specific vendor names in the answers.
Who handles login? The answer should be a name: Auth0, Clerk, Supabase Auth, Cognito, Firebase. If the answer is "we built it, it's pretty standard," you are paying a contractor to reimplement, in two days, a problem that a hundred engineers at a specialist company work on full time. Session handling, token expiry, password reset flows, rate limiting on login attempts. Custom auth is the single most common thing I inherit and the single most common thing I throw away.
Who touches card numbers? The correct answer is "nobody here, Stripe's hosted checkout does." If your own form fields ever hold a card number, even briefly, even in transit, you have taken on a compliance burden you did not budget for and cannot pass an audit on.
Where do uploaded files go, and who can read them back? Direct-to-S3 with signed URLs, or an equivalent. If files land on your app server and get served back by your own code, that's a path-traversal bug waiting to be found by something that reads a thousand repos an hour.
Who can see the admin panel, and how is that checked? Not "it's at a URL nobody knows." Role checks on every endpoint, server side, not just hidden buttons in the UI.
Four questions. No code required. If the answers are vague, you've learned something more valuable than any pen test would tell you at this stage.
Which corners I still cut
I ship fixed-scope MVPs for founders, so I am not going to pretend I build everything to bank standards in three weeks. I cut plenty.
I skip most automated test coverage on the first build, because the product is going to change shape twice before anyone depends on it. I skip fine-grained permissions and ship two roles, user and admin, because a permission model designed before you have customers is a guess. I skip multi-region, I skip queues until something is actually slow, I skip the audit log until someone asks for it. I run on managed Postgres and a platform host and I don't think about servers.
What I never cut: auth, payments, file handling, admin authorization, and secrets management. All five are bought, not built. Not because I can't write them. Because writing them is the expensive choice disguised as the cheap one, and the difference in build time is two days, not two weeks.
That trade was defensible when custom code was effectively unread. Custom code is now the cheapest thing in the world to audit and the most expensive thing you own. Every hand-rolled line is surface area that something can read faster than the person who wrote it.
What this actually costs you to get wrong
Not a breach headline. You're too small for a headline. You get a customer's data in a paste site, a support inbox you're not staffed for, and the enterprise deal you were chasing asking for a security questionnaire you now have to answer honestly. For a pre-revenue company, that's not a security incident. That's the end of the fundraise.
The fix is unglamorous and mostly a purchasing decision. Buy the boring pieces. Ask the four questions. Make the answers a line item in the contract before the build starts, not a discovery you make in month eight.
If you already have a build in flight and no one technical on your side to ask, that's a two-week problem, and it's roughly what a fractional CTO sprint at $4,500 exists to solve. Send me the repo access and the contract. I'll tell you which of the five got hand-rolled.