When did you actually start taking auth seriously?
A big part of my week is spent talking to early-stage founders about how they handle login, access, and identity, and there is a pattern I keep noticing that I want to understand better.
Almost everyone puts auth off at the start, which honestly makes sense when you are still trying to prove the product matters at all.
But then something forces the issue, a customer asking for SSO, a security review with a long list of questions, or a near miss where a credential almost leaked.
I am curious about your own version of that moment.
When did you decide to take auth seriously and put real time into it?
What was the thing that finally pushed you, and looking back, do you wish you had done it earlier, or was waiting genuinely the right call for where you were?
Replies
the day it stopped being 'security theater' and became 'my problem' was the day a user emailed me a screenshot of activity in their account they didnt make. every founder pushes auth before that email. every founder rewrites their entire auth surface after it. its a delayed-consequences problem masquerading as a compliance one, and thats why compliance docs never scare people into action on their own.