When Cheap and Fast Become Expensive: Real Security Issues I Recently Found

I recently reviewed a platform for a client and I’ll be honest. The findings were concerning. On the surface, everything worked. Users could log in. Pages loaded. Payments were wired up. To a non-technical eye, the system looked perfectly fine. Under the hood, it was a different story. Here are just a few real issues I encountered: A private SSH key was committed directly into the repository. This alone can give attackers server access if not rotated immediately. The Django SECRET_KEY was hardcoded and reused across multiple services. That breaks a core security assumption and increases blast radius if compromised. There was a test endpoint capable of resetting all user passwords to 123456. In production. The social login flow issued authentication tokens without properly verifying the provider token. In some cases, an existing user could receive valid tokens based only on email matching. The password reset flow did not properly validate OTP or reset tokens. User information could be fetched without authentication in certain endpoints. Auth tokens were being logged to the browser console and stored in JavaScript-readable storage. WebSocket authentication tokens were passed in URL query strings over non-TLS connections. And one of the most serious problems: Bank and payment details were stored as plain text in the database. Take a second to think about that. If that database leaks, those details leak with it. Why This Keeps Happening We are seeing more and more projects built through: Very cheap Fiverr gigs Heavy AI-generated codebases Rush-to-launch development Non-specialized generalists To be clear, tools like Base44 and Lovable are genuinely impressive. They can generate functional systems quickly. But today they still commonly fall short in areas like: WCAG accessibility compliance Clean SEO foundations Long-term maintainability Production-grade security hygiene And many developers who are not security-minded do not prioritize these either. The Dangerous Illusion One of the biggest problems in this industry is that broken architecture often looks fine from the outside. The site loads. Users can sign in. Payments appear to work. So stakeholders assume everything is healthy. Security debt and architecture debt are silent at first. They only become visible when something breaks, data leaks, or the system needs to scale. By then, the “cheap build” becomes very expensive. The Reality: Pick Two In the real-world, you can reliably optimize for two of the following: Fast Cheap High quality Getting all three at once isn't possible. Cheap and fast usually means corners were cut somewhere. Sometimes in performance. Sometimes in maintainability. And too often, in security. When AI and Cheap Builds Do Make Sense AI tools and budget builds absolutely have their place. They are often fine for: Simple landing pages MVP prototypes Internal tools Short-lived marketing sites But when you are dealing with: User accounts Authentication Payments Bank details Subscriptions Real customer data You are no longer in “just make it work” territory. You are in risk management territory. The Bottom Line Cheap is not automatically bad. AI is not automatically bad. Fiverr is not automatically bad. But if no experienced developer reviews the architecture, security, and data handling, you are taking a real risk. Especially if financial data is involved. If you are building something serious, treat security and code quality as first-class requirements, not optional upgrades. Your future self will thank you. CodeCrafter Crafting Code, Creating Solutions