I built a tool for a bootcamp project. During the demo, the judge stopped me and asked two questions:

"How are you going to know if the person using this isn't from the company you built it for?"

"Why is it letting me try and try? There's no limit. How are you even handling auth?"

I had no answer to either. I'd built login. I'd built sessions. And I'd never once thought about what happens after — who's watching, what's normal, what's suspicious, what happens on attempt #47.

That was months ago and I still think about it. It's the reason I started looking into auth monitoring for small teams. The uncomfortable thing I've found since: most small apps — mine included — have zero visibility.…