I'm not a developer by trade. I'm a self-taught builder who spent 26 years running a real business, got frustrated with every piece of software on the market, and built my own — Invven, an AI-powered invoicing and job management platform for trade businesses.
When you build your own SaaS, security isn't something you think about on day one. You're too busy building features, fixing bugs, and trying to get your first customers. But the moment real businesses start putting real data into your platform — customer records, invoices, payment details — security stops being optional.
Here's what we did, what we found, and the tools we used.
The Wake-Up Call
We had 5 API keys committed to our git repository.
Not intentionally. It happens gradually — a key gets pasted into a config file during development, gets committed before anyone notices, and sits there in version history forever even after you think you've removed it.
We caught it during a routine audit. All 5 were rotated immediately. But it was a reminder that security has to be deliberate, not accidental.
The Tools We Used
- Viberank (viberank.dev) This was our first full security scan. It found 12 issues including a HIGH severity finding — our Sentry route manifest was publicly exposed, leaking internal route structure. We wouldn't have found that without a dedicated scan.
- Mozilla Observatory (observatory.mozilla.org) Free, instant, no signup required. Checks your HTTP security headers — Content Security Policy, X-Frame-Options, HSTS, and more. Run this first. It takes 30 seconds and tells you exactly what's missing.
- SSL Labs (ssllabs.com/ssltest) Checks your SSL/TLS configuration in detail. Flags weak cipher suites, expired certificates, mixed content issues. Aim for an A rating.
- SecurityHeaders.com Paste your URL in and get an instant grade on your security headers. Free, no account needed. Good for a quick sanity check after any infrastructure change.
- Snyk Scans your codebase and npm dependencies for known vulnerabilities. Particularly useful if you're running a Node.js stack — the dependency chain in a modern JavaScript project is enormous and vulnerabilities appear regularly in packages you've never heard of.
- OWASP ZAP The industry standard for penetration testing. Free and open source. More technical than the others — requires some setup — but gives you the most comprehensive picture of what an attacker might find.
What We Fixed
Beyond the API keys and Sentry exposure, here's what we hardened:
Row Level Security on every table — we run Supabase with PostgreSQL. Every single table has RLS enabled. Tenant data is isolated at the database level, not just the application level. If the application layer is compromised, the database still protects each tenant's data from every other tenant.
Per-user rate limiting on all AI endpoints — AI features are expensive to run. Without rate limiting, a single bad actor could run up enormous costs or degrade performance for everyone. Every AI endpoint now has per-user limits.
Stripe webhook signature verification — every incoming Stripe webhook is verified against a signing secret before being processed. Without this, anyone could send a fake payment confirmation to your endpoint.
CORS tightened on public routes — we locked down which origins can make requests to our API. Easy to overlook, easy to fix.
DOMPurify XSS protection — any user-generated content that gets rendered back to the browser is sanitised. Cross-site scripting is one of the most common attack vectors and one of the easiest to prevent.
Admin routes owner-only — our admin panel is locked behind an owner-level check, not just an auth check. Being logged in isn't enough.
What We Learned
- Security is never done. Every new feature is a potential new attack surface. Build security into your development process, not as an afterthought.
- Scan before you launch — and keep scanning. We ran our first proper scan post-launch. Don't do that. Run it during development and again before go-live.
- The easy wins are genuinely easy. Security headers, SSL config, rate limiting — none of this takes long to implement. Mozilla Observatory and SecurityHeaders.com will tell you exactly what to fix in under a minute.
- Your dependency chain is a liability. Every npm package you install is code written by someone else, maintained by someone else, and potentially vulnerable. Run Snyk regularly.
- Commit hygiene matters. API keys in git history don't go away when you delete the file. Use environment variables from day one and scan your history with tools like git-secrets or truffleHog.
The Bottom Line
If you're building a SaaS and you haven't run a security scan yet — do it today. Start with Mozilla Observatory and SecurityHeaders.com. Both are free, both take under a minute, and both will likely find something.
Your customers are trusting you with their business data. That trust is worth protecting.
Building Invven — AI invoicing and job management for trade businesses. Self-developer. 26 years in business. Still learning.
Top comments (0)