A colleague once suggested we finish the core system first and add security later. I refused.
Security is not a layer. It is a posture. It shapes every table you design, every API you expose, every session you manage. You cannot retrofit the mindset.
Bolting security on after the fact gives false confidence — which is worse than nothing.
Build the lock before you build the door. That is the only sequence that works.
— Dick Bassey | DevDick | 2009