I&#x27;d argue that all code should be fairly defensive.
Security flaws in the end are just bugs. And defensive programming helps reduce bugs.
As for toy projects - you never know when your futzing around becomes a full blown product.<p>Obviously, security is always a tradeoff. I&#x27;m not suggesting you implement 2 factor authentication for your wedding invite website. But it does always help to consider:
1. How can this code break, if someone accidentally misuses it?
2. How can this code break, if someones intentionally misuses it?<p>Very often, thinking about #2 can help resolve a lot of things overlooked in #1.