1. Just because you moved something from being a GET parameter to a POST parameter so I couldn’t see it in the URL bar doesn’t mean that I don’t know it is there. And it also doesn’t mean I can’t change it. (Download WebScarab if you disagree)
2. Just because you put something in a hidden FORM parameter doesn’t mean I can’t find it. Or change it. See #1.
3. Ditto for cookies. See #1.
5. I love it when you say “That would never happen in production.”
6. I really love it when you say “An attacker would never do that.”
7. I really hate strong server side input validation.
8. That page with the detailed error message – my job would be way harder without it.
9. Most of those “Guaranteed Secure!” banners you put on your site only serve to tell me you don’t understand the first thing about security.
10. That web application scanner you ran – it didn’t find everything. Not even close.
11. That network scanner you ran – it didn’t even start testing the security of your application.
12. I understand AJAX (or fancy, new technology “XYZ”) better than you do.
13. The more clever you think you are – the better I feel.