Developer finds CI catches dependency and security gaps missed in local environments

A backend developer shared lessons learned after setting up continuous integration (CI) on a solo project. The first CI run immediately revealed an undeclared dependency that worked locally but was missing from requirements.txt, exposing a classic environment mismatch. A pinned package version was also silently overwritten by a later install, a drift that went unnoticed until a manual code review. The developer also highlighted a deliberate API design choice: returning 404 instead of 403 for resources owned by other users, to avoid confirming whether a resource exists. The takeaway is that good backend hygiene relies on automated checks rather than memory or assumptions.