I found a privilege escalation bug in my own SaaS a week before launch

Was doing a routine security pass on AI Control Center (a dashboard for teams tracking spend across OpenAI, Anthropic, Gemini, Bedrock) and found that team members with "Developer" role could silently gain Owner-level permissions through a gap in how team_members.permissions was being checked.

Nobody exploited it — I caught it myself — but it made me realize how much of my "done" feature list was actually just "works when nobody's trying to break it."

Spent the following two weeks doing a full audit instead of shipping features: DB-level triggers to enforce plan limits (not just UI gating), closed an open email relay, hardened the cron functions. Zero of it is visible to users. All of it felt mandatory before I'd trust the product with real customer data.

For other solo founders here — how do you decide when security work is "enough" vs. just an infinite time sink that delays launch forever?

controlaicenter.com if you want to see what came out of it. Still free