"Security isn't about building walls. It's about understanding how someone will try to climb over them."

Most developers build software with one person in mind: the user.

Attackers don't.

While you're thinking about user journeys, feature releases, and improving UX, attackers are asking very different questions:

Can I bypass authentication?