My bootcamp judge asked me two questions about auth that I couldn't answer

khadijah sheikh — Fri, 30 Oct 2026 17:00:58 +0000

I built a tool for a bootcamp project. During the demo, the judge stopped me and asked two questions:

"How are you going to know if the person using this isn't from the company you built it for?"

"Why is it letting me try and try? There's no limit. How are you even handling auth?"

I had no answer to either. I'd built login. I'd built sessions. And I'd never once thought about what happens after — who's watching, what's normal, what's suspicious, what happens on attempt #47.

That was months ago and I still think about it. It's the reason I started looking into auth monitoring for small teams. The uncomfortable thing I've found since: most small apps — mine included — have zero visibility. You find out something was wrong when a customer tells you, or never.

So, to anyone who's actually run a production app:

Do you monitor auth events at all, or is it "check the logs if something feels off"?

Have you ever caught something suspicious in time to do anything about it?

If you use something like fastapi-sentinel or django-axes, what does it catch, and what does it miss?

Not selling anything — genuinely trying to learn what "good enough" looks like, because mine was "hope nothing happens."

Tags: #python #fastapi #security #discuss

I run a small FastAPI app and have basically zero visibility into auth activity. If someone hammered my login endpoint or signed up with throwaway emails, I'd find out weeks later—or never. How do others handle this?

khadijah sheikh — Fri, 30 Oct 2026 16:53:13 +0000

DEV Community: khadijah sheikh

My bootcamp judge asked me two questions about auth that I couldn't answer

I run a small FastAPI app and have basically zero visibility into auth activity. If someone hammered my login endpoint or signed up with throwaway emails, I'd find out weeks later—or never. How do others handle this?