Every security decision is a trade against convenience. The fastest setup is always the least secure. The most secure setup is unusable. Solo dev work lives at a specific point on this curve, and it is not the same point as a bank's or a startup's.
| Convenience choice | Security cost | Solo-dev verdict |
|---|---|---|
Bind to 0.0.0.0 for "easy phone access" | Universe-scale exposure | Don't — use Tailscale instead |
| No login on internal app | Anyone who reaches it = admin | OK only behind Tailscale + lockscreen, never both off |
| Same SSH key everywhere, no passphrase | One stolen key = total fleet | Acceptable if disk encryption + Touch ID/FIDO2 |
| Skip 2FA on hosting account | Email compromise = control panel | Always 2FA. No exceptions. |
| Save passwords in browser | Browser sync = whoever has your laptop has your accounts | OK if disk + login encryption is real; better with manager |
| Auto-login to your dev box | Anyone with physical access wins | Don't — even at home; visitors and kids count |
The asymmetry that matters
The cost of setting up a layer is paid once. The cost of not having it is paid in a single bad day. That asymmetry is the entire reason this quest exists — the upfront work is small; the without-it tail is enormous.