Not even trying. Seriously, you wouldn't believe the number of companies/people who don't even try. I'm talking "db.run(request.body)" levels of not-trying, "t

Not even trying. Seriously, you wouldn't believe the number of companies/people who don't even try. I'm talking "db.run(request.body)" levels of not-trying, "the shared admin password is 'turtle'" levels of not-trying; "the medical records are protected because they're on a hidden share" levels of not-trying. These are all things that I've seen. Second to that is thinking that you're trying because every once in a while you have a vague sense of paranoia. "Let's use MongoDB so we're safe from SQL injection." "We need to proxy the API because that's what other people do." "The WiFi password is secure because it's 26 characters long -- even though we're still using WEP." Also things I've seen. I know I'm not any better either. Given the opportunity, I would always hire a professional to audit my stuff.