A single XSS can kill your startup
Everyone talks about churn from bad UX, slow load times, confusing onboarding, a button that doesn't work on mobile. The discourse around "losing users" is almost entirely product-focused.
Nobody talks about what happens when your update endpoint serves a javascript: URI to every user who checks for a new version. Or when your release notes field, the one that accepts markdown, gets used to inject a script tag into every client that renders it. Or when your static release token has no rate limiting, so an attacker has unlimited attempts to brute-force it.
These aren't theoretical scenarios, they're the kinds of findings that show up in a routine PR audit on a Tool version management system. And unlike a broken modal or a confusing signup flow, you don't get a Hotjar recording that tells you something went wrong. You get a breach report or you get silence, and find out six months later.
The vulnerability that doesn't look like one
