When "Polish Over Security" Costs Real Money

A potential client sent me their React + Firebase app for review. "Need some help polishing before MVP launch," they said. "Focus on features and usability first — security can wait." I opened the c