Using external services can be a valid choice, but not understanding how auth works under the hood is a much bigger risk.

Auth-as-a-service vendors often market through fear, making basic authentication seem inaccessible. OAuth, for example, does not require Firebase or any specific provider—it’s a standard protocol.

Most wealthy people sell products, though you can also get rich selling services—footballers are proof.

If you have no startup capital, start by selling a service, especially one that helps people with money save time or costs. Products, however, are the best long-term play because they scale and aren’t tied to your time.

Result: You have a "Ghost Post." It exists in the database, but downstream (Search, Feed) never heard about it because the event was never sent.

How do you fix this ?

Importantly, the recent patch for the React2Shell Remote Code Execution exploit remains effective, and developers are encouraged to update and review their server component usage to mitigate these new findings.