Completely agree, and it worries me. But at the same time, if I don't have more refined user education, or if we don't add feature X that customer Y wants to pa

Completely agree, and it worries me. But at the same time, if I don't have more refined user education, or if we don't add feature X that customer Y wants to pay big money for, we don't survive long enough for me to one day fix our security. I worry about this stuff all the time, but based on the way some of my partners act, I sometimes also feel guilty for worrying. It seems like I'm shouting at a corner or wanting to waste time on something that "Isn't an issue yet". Just the other day a friend claimed that worrying too often about security was a form of premature optimization. I thought he was joking. He wasn't. From the article: I don't even mention middle and small websites. they're just doomed... Being at a small website and working day and night, at the end of it I look back, feel like I've accomplished a lot, but deep down know that I understand almost nothing about the security implications for 90% of what I touch. My security is based on obscurity. I know it. And it keeps me up at night.