Attacks are rarely creative. Automated bots knock on known doors in order and walk through whichever is unlocked. Which means locking five known doors stops most of them.
1. Authorization enforced only in the interface
The most common and most dangerous. Hiding an admin button in the interface is not protection: typing the address directly or replaying the request goes straight through. Authorization must run on the server, on every request.
2. Database rules left open
When the browser talks to the database directly, as with Supabase or Firebase, the security rules are the only lock. Shipping with everything allowed for convenience means any user can read everyone else data.
3. Trusting user input as-is
Attackers put database commands or scripts into input fields. Every place a user types is a target: search boxes, login forms, post editors. Input must be handled both when stored and when rendered.
4. No rate limiting
If one person can repeat a request without limit, two things follow: passwords get brute-forced, and paid APIs get called until the bill explodes. The second costs you money even when the attacker gains nothing.
5. Unrestricted file uploads
Without size and type limits, storage fills up quickly or an executable file lands on your server. If you only want images, verify the actual file content rather than the file extension.
Perfect security does not exist, but you can avoid being the easy target. Bots do not force a locked door when the neighbour left theirs open.