Dude thank you for your detailed reply which I have been thinking about for a while.
I don’t want to mischaracterise what you’re saying but I want to try to summarise the lessons, which I think are super valid.
- Some external layers or services are basically essential, like a WAF/auth/rate limiter/API gateway/reverse proxy. Or DB.
- Observability and logging, and rapid response to anomalies, together with a honeypot, go a long way toward maintaining security.
This is definitely a way to think about this that I haven’t distilled. Thanks!