The title should be: Don't assume security is happening automatically under the hood. Even if using a web framework which supports security out of the box, don

The title should be: Don't assume security is happening automatically under the hood. Even if using a web framework which supports security out of the box, don't take it for granted either. For example: that's a common error developers make when using Spring Security. It's powerful and full-featured, and developers get security and everything in a breeze, but when doing things on the fly misconfiguration happens and vulnerabilities are out there in the open.