Your SaaS is live. Users are paying. And somewhere in the back of your head a small voice keeps whispering: is any of this actually secure?
Good. That voice is right to be nervous.
I come from penetration testing. For years my job was to find the one door you forgot to lock. Here is the uncomfortable truth I learned doing it: most startups do not get owned by some genius with a zero-day. They get owned by boring stuff. A missing check. A key in a public repo. An endpoint nobody rate limited.
So forget the hacker-in-a-hoodie image. You can close the loud 80% of your risk in a single weekend. Here is exactly how I would spend it, in order.
Saturday morning: lock the front door
Start with transport and identity, because that is what everyone touches first.
HTTPS everywhere. No exceptions, no "it is just the staging box." Redirect every HTTP request to HTTPS and turn on HSTS so browsers refuse to downgrade. Free certs from Let's Encrypt mean you have zero excuse in 2026.
Then auth. Do not roll your own. Use a battle-tested library or a provider, and turn on MFA, at least for admin accounts. The number of breaches I have seen that started with one reused admin password is genuinely depressing. Hash passwords with argon2 or bcrypt, never plain text. If you are writing your own crypto, stop and go get a coffee instead.
Saturday afternoon: trust nothing from the client
This is the part that separates real apps from demos.
The browser is not your friend. Anything the client sends can be faked. So every sensitive action has to be re-checked on the server. Can user A edit user B's invoice just by changing an ID in the URL? If you only hid the button in the UI, the answer is yes, and that is a real problem.
Server-side authorization on every endpoint. Validate and sanitize every input. Use parameterized queries so a name like O'Brien does not break your database, or worse. Treat user input as hostile until proven otherwise, because sometimes it genuinely is.
Sunday morning: stop the abuse
Now the loud attacks: brute force, scraping, spam.
Rate limit your auth routes first. A login endpoint that accepts unlimited attempts is a gift to anyone holding a password list. Add sane limits per IP and per account. Put your CDN or a WAF in front if you can. Drop a captcha on signup if bots are already hammering you.
And secrets. Get your API keys, database URLs and tokens out of the client bundle and out of git. They belong in environment variables or a secret manager, full stop. Rotate anything that ever touched a screenshot or a Slack message.
Sunday afternoon: assume you will fail
You will get something wrong eventually. Mature teams plan for that instead of pretending otherwise.
Backups, automated and tested. A backup you have never restored is a rumor, not a backup. Logging that captures who did what and when, so when something looks off you can actually see it. Alerts on the scary events: failed logins spiking, a sudden burst of 500s, an admin action firing at 3am.
None of this is glamorous. All of it works.
Here is the mindset shift that matters more than any single line on the list. Stop asking "am I hackable?" and start asking "when someone tries, what stops them, and how fast will I know?" That second question is what security actually is.
Do the weekend. Your future self, reading an incident report that never had to be written, will thank you.
I am Ksatria Bintang Samudra, an AI-native full-stack engineer with a penetration-testing background and a deep interest in digital forensics, open to remote work worldwide. More of what I build at ksatriabintangsamudra.com.
Top comments (0)