My bootcamp judge asked me two questions about auth that I couldn't answer

I built a tool for a bootcamp project. During the demo, the judge stopped me and asked two questions:

"How are you going to know if the person using this isn't from the company you built it for?"

"Why is it letting me try and try? There's no limit. How are you even handling auth?"

I had no answer to either. I'd built login. I'd built sessions. And I'd never once thought about what happens after — who's watching, what's normal, what's suspicious, what happens on attempt #47.

That was months ago and I still think about it. It's the reason I started looking into auth monitoring for small teams. The uncomfortable thing I've found since: most small apps — mine included — have zero visibility. You find out something was wrong when a customer tells you, or never.

So, to anyone who's actually run a production app:

Do you monitor auth events at all, or is it "check the logs if something feels off"?

Have you ever caught something suspicious in time to do anything about it?

If you use something like fastapi-sentinel or django-axes, what does it catch, and what does it miss?

Not selling anything — genuinely trying to learn what "good enough" looks like, because mine was "hope nothing happens."

Tags: #python #fastapi #security #discuss