[giancarlostoro]

I never said anything about before hitting production, I said do you build everything in one shot when you start a brand new project, in one sitting.

[habinero]

Why are you building and deploying a site critical enough to need CSP and user security & so on in one sitting lol

Anyways, yes, if I know I'm gonna need it? Because every framework has reasonable defaults or libraries for all of those things, and if you're in a corporate environment, you have vetted ways of doing them

1. import middleware.whatever

2. configure it

3. done

Like, you don't write these things unless you need custom behavior.