The week before I invited anyone to use the backend framework I built, I stopped adding features and ran a security audit on it.

Not because I expected it to come back clean. Because shipping a backend without ever checking it is how solo projects quietly leak — and the leak is always discovered by someone who isn't you, at a time you didn't choose.

Yatta JS is my backend-as-a-server for Bun: database, auth, mail, storage, realtime, jobs, and observability in one process. One runtime instead of five services to wire up and keep patched. The whole point of that design is fewer moving parts. But fewer moving parts doesn't mean fewer things to check — it means the things you do check matter more, because there's no second service to catch what the first one missed.

The audit wasn't a ceremony. It was three questions, asked in order:

1. What does this expose by default?

Every route, every endpoint, every port — what can someone reach without asking, and is that the list I actually intended? Defaults are the part of a framework most people never read, and they're the part attackers read first. If something is open, it should be open because I decided it, not because I never looked.

2. Where does auth actually get enforced?

Not where the docs say it gets enforced. Where the code checks it, on every path a request can take — including the ones I added late, in a hurry, at 2 a.m. A single route that skips the check undoes all the others.

3. What happens when the input isn't what I expected?

Wrong types. Missing fields. Absurdly long strings. A request that looks almost right but isn't. A backend's job is to say no cleanly to all of that, not to crash, not to guess, and definitely not to pass it straight through to the database.

Here's the honest part: an audit is a point-in-time check. It tells you what was true on the day you ran it. It doesn't make the code bulletproof, and it doesn't stay true by itself — every feature you add afterwards is a new thing that needs the same three questions. So the audit isn't a one-off event. It's a habit you repeat, ideally before every release that touches what the outside world can reach.

What the audit gave me was a list. Not a badge — a list. Fix the list, then ship. That list is the difference between "I think it's fine" and "I checked, here's what I found, here's what I fixed."

If you're building a side-project backend, run the check before real users arrive, not after. You don't need a security team to do it. You need an hour, the three questions above, and the willingness to write down what you find instead of explaining it away.

Yatta JS is on npm as yatta.js — install it with npm i yatta.js. Docs: https://yatta.js.org — Code: https://github.com/psrockstar098/yatta.js

What check do you never skip before shipping?