Exactly. It is like running your own authentication system in production without deeper knowledge in CS. It works well, until it doesn't.