Ten Dealbreakers Every Web Engineer Must Know

A Checklist for Evaluating Tech Companies' Codebases

When joining a new tech company, their codebase and engineering practices often reveal more about the company's culture than the interview. Missing fundamental web and security concepts usually points to significant technical debt and a disregard for user safety.

Here is a list of fundamental concepts that web software engineers should know, ranked from critical security risks to important web fundamentals. Most of the security items map to the OWASP Top Ten. Spotting these in a production environment is a strong indicator of systemic issues.

1. Storing Passwords in Plain Text

This is a critical security failure. If a database is breached and passwords are in plain text, the damage to users is severe, especially since people reuse passwords.

Passwords must always be hashed and salted using robust algorithms like bcrypt or Argon2 to ensure user credentials remain unknown even to the system administrators.

2. Vulnerability to SQL Injection (SQLi)

Finding backend code that builds SQL queries by concatenating raw user input strings means the application is open to attack and database compromise.

Engineers must use parameterized queries, prepared statements, or modern ORMs to ensure database engines treat input as data, never as executable commands.

3. Untested Backups (Schrödinger's Backup)

Failing to back up a production database is dangerous, but backing up data without ever testing the restoration process carries the same risk. If the database drops, the company data might still be unrecoverable.

Automated backups should be paired with scheduled, routine restoration tests to ensure the data is usable in an emergency.

4. Hardcoding Secrets in Source Code

API keys, database credentials, AWS access keys, or encryption keys should never be hardcoded into the Git repository. A single repository leak compromises the infrastructure.

Configuration and secrets must be injected via environment variables (.env files) or managed by a dedicated secret manager like AWS Secrets Manager or HashiCorp Vault.

5. Editing Code Directly on Production ("Cowboy Coding")

If there is no local development environment or staging server, and engineers are editing files on the live production server, simple errors can cause immediate downtime.

Code must go through local testing, version control, and a CI/CD pipeline before reaching production.

6. No Version Control

How a team handles their code is a strong indicator of their maturity.

If a company passes code around via zip files or shared network drives instead of using a version control system like Git, collaboration becomes chaotic and risky.

7. No Password Managers

A team's credential management reveals its security culture. Passing shared root credentials or database passwords in plain text via Slack or sticky notes is a massive security vulnerability. A team password manager is mandatory.

8. Transmitting Sensitive Data over HTTP

In modern web applications, all traffic should be served over HTTPS. If login forms, personal data, or payment information are transmitted over plain text HTTP, anyone on the same network can intercept the data.

Enforce HTTPS everywhere and redirect HTTP traffic to HTTPS at the server or load balancer level.

9. Ignoring XSS (Cross-Site Scripting)

If the frontend renders user-generated content into the DOM without sanitizing or escaping it, malicious users can inject JavaScript to steal session tokens from other users.

Modern frameworks like React or Angular escape output by default when they render it. Any raw HTML input must be heavily sanitized before rendering.

10. Using GET Requests for Destructive Actions

HTTP verbs have specific semantic meanings. A GET request should only retrieve data. GET must be safe: calling it must not change state, no matter how many times it runs.

If deleting a user account is done via a GET request (e.g., hitting website.com/api/deleteUser?id=5), web crawlers, browser prefetching, or an accidental page refresh could wipe out data. State-changing actions must use POST, PUT, PATCH, or DELETE methods.