I run a small web app that makes a little bit of money through ads.

People commonly give the advice that you should ask your users for payments if you want to keep your web app alive.

I do not know if people will pay for this app, but recently, I decided that I would add some for-pay features to my app.

I mentioned my decision to a friend. He said "Aren't you concerned that accepting payments may open your site up to attackers or abuse?" I pressed him, but he couldn't come up with a reason for asking. This idea had not occurred to me.

So, I'm asking you, people of HN: is my friend just paranoid? Have you heard about something bad happening to a website or app after payments were added? Do you have experience with this problem, or was it never a problem for you?