Identity is the one layer of a system where every shortcut compounds. A skipped test can be rewritten. A slow query can be tuned. But a login system built on assumptions — trusted networks, small teams, “we’ll add SSO later” — hardens into the foundation, and everything above it inherits the weakness. By the time it matters, replacing it means touching every user, every integration, and every customer contract.

I read the identity layer first in every audit, because it is where shortcuts turn into liabilities fastest. Here is what I keep finding.

1. The homegrown login

“We built our own auth — it was faster.” It always is, at first. Then the requirements arrive: password reset flows, brute-force protection, session revocation, device management, audit logs. Each one is a security feature the team now owns forever, written by people whose job is shipping product, not studying authentication attacks. I have never audited a homegrown login system that handled all of these correctly. The honest ones admit it; the dangerous ones don’t know what they’re missing. In diligence, a custom auth system with no dedicated security review is a red flag with a timer on it.

2. “We’ll add SSO later”

Later arrives exactly when it hurts most: the first enterprise prospect asks for SAML or OIDC integration during procurement, and the deal stalls for a quarter while the team bolts identity federation onto an architecture that never planned for it. I have watched this single missing feature kill deals worth more than the entire engineering budget that “saved” time by deferring it. The shortcut didn’t avoid the work — it moved the work into the sales cycle, where it costs revenue instead of story points. If your target customers include anyone with a compliance department, SSO is not a feature. It is table stakes, and its absence is a diligence finding.

3. Authorization in the frontend

This one should keep a board awake. The API happily serves data to anyone who asks; the only thing stopping users from seeing each other’s records is that the buttons are hidden in the UI. I find this more often than you’d believe, usually in systems that grew fast: the frontend was the product, the API was “internal,” and then the API became the integration surface for partners. Every shortcut in authorization becomes a breach disclosure waiting for a curious user or an automated scanner. The audit test is trivial — I just call the API directly. The number of times it answers is the number of times I have had an uncomfortable conversation.

4. Tokens that never die, secrets that never rotate

JWTs with no expiry. API keys committed to repositories three jobs ago, still valid. Service accounts shared across the whole company with a password in a wiki page. Secrets management is the least glamorous part of identity work and the most consequential when it fails. A build audit maps every credential in the system — where it lives, who can see it, when it was last rotated. The answer is usually “we don’t know,” which is itself the finding.

5. No audit trail

When something goes wrong — and in identity, “wrong” means unauthorized access — the first question is always “what did they touch?” If the system cannot answer, the incident response becomes guesswork, the customer notification becomes vague, and the compliance conversation becomes hostile. Logging who accessed what is not bureaucracy. It is the difference between a contained incident and an existential one. I ask for the access logs in every audit. A shrug here is one of the most expensive sounds in software.

The diligence checklist

If you are evaluating a company, the identity layer deserves twenty minutes of skeptical attention:

Clear answers mean the liability is managed. Evasion means it is compounding.

Why this matters more every year

Identity shortcuts used to be survivable because the blast radius was small. That era is over. Systems now hold regulated data, serve enterprise customers, and integrate with partners — every one of which inherits your identity posture. A shortcut taken to ship faster in year one becomes the reason a deal dies in year three, or the paragraph in a breach notification that names the company. The cheapest time to get identity right was at the start. The second cheapest time is an audit, before someone else finds it first.

GhostOp is a technical product studio with deep identity and security judgment. We find the signal inside difficult systems and make it real: what the shortcuts are, what they could cost, and what to fix first. See how the studio works.