"It works on my machine" is the engineering meme. The security version is darker: "it is accessible to me, therefore it is accessible to anyone with the same network position as me." That includes whoever borrows your laptop, whoever picks up your phone, and whoever is on your home Wi-Fi.
The solo-dev posture, in one sentence
Default-locked, opt-in unlocked, time-bounded sessions. Nothing is open unless I deliberately opened it. Open things automatically re-close. I can see at a glance what is currently open.
What that looks like concretely
| Aspect | "It works for me" default | "It is locked for anyone else" default |
|---|---|---|
| Network binding | 0.0.0.0 for convenience | Tailscale IP only; 0.0.0.0 requires a flag |
| App access | No login on internal tools | PIN by default; local IP bypass is opt-in |
| Sessions | "Stay logged in forever" | 30-day cookie max; revocable |
| Visibility | No admin dashboard | Active sessions, blacklist, and recent attempts visible |
| Failure mode | Brute force is silent | Failures lock and log; killswitch is one click |
The quest roadmap
The remaining 9 tracks build the "default-locked" posture, layer by layer — vocabulary, the bind decision, Tailscale, the PIN layer, brute-force defense, killswitch, dashboard, the LLM secrets-leak surface, and when PIN stops being enough.