The problem is with defining "works". If your code "works" with ten test entries in a DB when you test the happy path, it doesn't mean that it really works in p

The problem is with defining "works". If your code "works" with ten test entries in a DB when you test the happy path, it doesn't mean that it really works in production, with real load and real attack attempts on it.