Nobody sets out to ship a SQL injection. Nobody opens their editor thinking "today I'll hardcode a secret." It happens because, in the moment, you were sure the code was fine. You wrote it. You understood it. Why would you need a tool to double-check your own thinking?
That confidence is the problem. Not your skill - your certainty about your skill, at the exact moment you have the least perspective on it: right after you wrote the code, while you still remember why every line seemed like a good idea.
The Dunning-Kruger effect isn't about other people
Everyone's heard of Dunning-Kruger. Everyone assumes it's about the junior dev who doesn't know what they don't know.
It's more uncomfortable than that.
