training tracker: stage 2 — the security audit nobody asks for
second post in the training tracker series: before adding a single new feature, the working single-user app gets a proper security review. What an audit of a small web app actually looks at, and why shipping something is the start of the job, not the end of it.