I don't think survivorship bias is over-estimating your chance of success. It's judging what works only on successful things.
The cannonical example being planes that made it back in WWII being the model for where the plane body should be reinforced, which was not helpful because it's the planes that don't make it back that tell you where the problems are.
So in web development that would be akin to using projects that have never been hacked as your model for where to harden security.
It's the projects that get hacked that reveal the weaknesses.
I don't think survivorship bias is over-estimating your chance of success. It's judging what works only on successful things.
The cannonical example being planes that made it back in WWII being the model for where the plane body should be reinforced, which was not helpful because it's the planes that don't make it back that tell you where the problems are.
So in web development that would be akin to using projects that have never been hacked as your model for where to harden security.
It's the projects that get hacked that reveal the weaknesses.
Great comment, thanks for that WWII planes trivia :)