22/09/2026
Most security checklists you can work through from your laptop. "Test as an untrusted user" is the one item you can't.
You built it, you're on its network, you hold its credentials. From inside, everything looks right — which is why it proves nothing.
Rent a machine with a different IP. Hit your admin routes with no cookie, push signup past its rate limit, read your own error pages from outside.
$0.012/hour, delete it when you're done.
https://go.lightnode.com/hourly-billing-vps