What security mistake do developers underestimate the most?

Security often gets treated as a separate department, but many serious vulnerabilities begin with extremely ordinary development decisions.

A missing authorization check. An exposed API key. Weak session handling. Unsafe file uploads. Trusting data that came from the client. Leaving development endpoints enabled. Using a dependency without understanding what it actually does.

The interesting part is that these mistakes aren't usually caused by someone deliberately writing "insecure code." They happen because a developer is focused on functionality and assumes another layer will take care of security.