04 Oct 2025 · Security
By Yerlin Ugarte
A public demo should never become a leak. Security is a list of refusals as much as a list of features.
Studying cybersecurity with Cisco did not make me a red-team specialist. It made me suspicious of convenience. Default open forms, client-side-only validation, personal data in logs, admin pages without a gate — these are not edge cases. They are how small sites get hurt.
On every public product I ask: what should this page refuse to store? If it is a clinic, real medical records do not belong in a marketing demo. If it is a municipality, a suggestion box is not a civil-registry database. Scope is a security control.
The rest is hygiene: HTTPS, least privilege, dependency discipline, and the humility to keep learning. Threats move. So should the practice.