Most web app hacks don't start with exotic zero-days, they start with everyday misconfigurations. The CodeRabbit incident is the latest reminder. Here are key lessons and best practices (secrets managers, outbound restrictions, sandboxing, log monitoring) that every app team should apply now.