Field notes
No Battery in the Detector
A house can pass inspection, appraise clean, and feel perfectly safe, and still have a smoke detector on the hallway ceiling with no battery in it. It looks right. It's mounted where it should be. It does nothing on a good day, which is most days, so nobody thinks about it. It earns its entire existence on one bad night, and by then the question of whether anyone put the battery in has already been answered for you.
I went looking for those empty detectors last week, across forty apps.
They were all built with the describe-it-and-ship-it tools, the ones that turn a paragraph of English into a working product over a weekend. The internet has mostly decided these apps are a security dumpster fire, a pile of leaked passwords waiting to happen, and I will admit I went in expecting to come back with a trophy wall of somebody's secret keys sitting right there in the page source. I looked only at what any visitor can see: the pages themselves, the code the browser downloads, the doors that face the street. I didn't break in, and I didn't touch anything I wasn't handed.
What I found surprised me, and I want to be fair about it, because fair is more interesting than a dunk.
Nobody left the good silver out. Across all forty, I did not find a single leaked secret key, no admin password hiding in the code, no unlocked back door into the money. Some of these apps do ship a key right there in the browser, and that sounds alarming until you realize it's the kind of key that's supposed to be public, the way your street address is public. Sixteen of them did exactly that, and every one was the harmless, by-design sort. Whatever these tools are doing, they are getting the genuinely dangerous part right, and that deserves saying out loud.
The detector, though. The battery.
Of the forty apps, I could actually reach twenty-six of them. The other fourteen sat behind a login wall or a bot check or had quietly gone dark, so I can't tell you a thing about them, and I'm not going to pretend I can. Of the twenty-six I could see, twenty-four had no Content Security Policy. That's ninety-two percent of the ones I could inspect, and even if you count the fourteen I couldn't as a total mystery, it's still more than half of everything.
A Content Security Policy is the battery in the detector. It is boring and invisible and does nothing on a good day. It just sits there. It only does its job on the bad day, the one where somebody tries to slip something nasty onto your page, and the policy catches it, and the whole event passes without a single one of your users ever knowing there was a moment. Almost none of these apps had one. One more little safeguard was missing just as often, the latch that keeps a stranger from wrapping your site inside theirs and tricking people into clicking things they never meant to click. A couple of others turned up missing here and there too. Cheap hardware, all of it. The kind nobody thinks about until the night they wish they had.
What stopped me from feeling clever was realizing none of this is the builders' fault. Nobody handed them the battery. The tool built the house, painted it, walked them to the door, dropped the keys in their hand, and never once mentioned that the detector on the ceiling shipped empty. You wouldn't install a thing you were never told you needed. You'd move right in. You'd sleep fine, right up until you didn't.
Nothing going wrong is not the same as everything being fine. Those are two completely different sentences, and the entire gap between them is where the trouble waits.
The good news is that the battery is cheap and the install takes about five minutes. It's a handful of lines of configuration, close to identical for almost everyone, and it turns a detector that only looks like protection into one that actually is. I ended up writing the whole thing down, the exact batteries for the exact detectors, because it felt wrong to notice the empty ones and walk off without leaving the hardware on the porch.
Go find the detector on your own ceiling tonight. Pop the cover. If there's nothing in it, you are in very good company, and you are also about five minutes from not being.