The locks beginners leave open.
Day 34 covered how login and permissions work. These are the mistakes that show up again and again in AI-generated apps.
Checks only in the browser
Other users' records by changing the URL
Passwords stored as typed
Admin pages protected by a “secret” URL
Default admin / admin accounts left in
No limit on login attempts
Sessions that never expire
Reset links that work more than once
If it's not checked on the server, it's not protected.