What AppSec Engineers Actually Do (and Why It Matters)

Imagine a team building a simple feature: an endpoint to let users download their invoices. The implementation is straightforward: check the user is authenticated, fetch the file, and return it. It passes code review, tests are green, and it ships. A few weeks later, someone realizes you can tweak a