Handbook
/
Product & Engineering
Security Basics Every Founder Should Know
Security isn't optional. Here's what every startup needs to get right, even before you have a security team.
Security is easy to ignore when you’re building fast. You’re focused on product, users, growth—security feels like something big companies worry about.
Then you get breached. Customer data is exposed. Trust evaporates. The company is set back months or killed entirely.
Security doesn’t require a dedicated team. It requires getting the basics right from the start.
The Real Risks
What actually happens to startups:
Credential stuffing. Attackers use leaked passwords from other sites to try to log into yours. If your users reuse passwords (they do), accounts get compromised.
SQL injection. Improperly handled user input lets attackers read or modify your database.
XSS (Cross-Site Scripting). Malicious scripts injected into your site steal user data or sessions.
Exposed secrets. API keys, database credentials, or encryption keys committed to code or exposed publicly.
Phishing. Attackers trick employees into giving up credentials or access.
Dependency vulnerabilities. A library you use has a security flaw that attackers exploit.
These aren’t exotic attacks. They’re common, automated, and target startups constantly.
Authentication
Use a Managed Service
Don’t build authentication yourself. Use:
•
Auth0, Clerk – Full-featured auth services
•
Supabase Auth – If using Supabase
•
Firebase Auth – If in Google ecosystem
•
WorkOS – For enterprise SSO
These handle:
•
Secure password hashing
•
Multi-factor authentication
•
OAuth flows
•
Session management
•
Security best practices
Building auth yourself means getting all of this right. It’s not worth the risk.
Enforce Strong Passwords
•
Minimum 12 characters
•
Check against known breached passwords
•
Don’t use complexity rules (they don’t help)
Most auth services handle this for you.
Implement MFA
Multi-factor authentication should be:
•
Required for admin accounts
•
Encouraged for all users
•
Available via authenticator app (not SMS if possible)
SMS 2FA is better than nothing but vulnerable to SIM swapping. Authenticator apps are better.
Secure Session Management
•
Use HTTP-only, secure cookies
•
Set reasonable session expiration
•
Invalidate sessions on password change
•
Implement session revocation for sensitive actions
Data Protection
Encryption at Rest
Encrypt stored data, especially:
•
User passwords (bcrypt, argon2—never MD5 or SHA1)
•
Sensitive user data (PII)
•
Backups
•
Database files
Most managed databases (Supabase, PlanetScale, AWS RDS) encrypt at rest by default.
Encryption in Transit
•
Use HTTPS everywhere (no HTTP)
•
Use TLS 1.2 or 1.3
•
Redirect HTTP to HTTPS
•
Use HSTS headers
Platforms like Vercel, Netlify, and Railway handle this automatically.
Minimize Data Collection
•
Only collect data you need
•
Delete data you no longer need
•
Be thoughtful about what goes in logs
You can’t leak data you don’t have.
Protect Secrets
•
Never commit secrets to code
•
Use environment variables
•
Use secret management (Doppler, 1Password Secrets, AWS Secrets Manager)
•
Rotate secrets periodically
•
Audit who has access to secrets
Input Validation
SQL Injection Prevention
Never interpolate user input into queries:
// BAD - vulnerable to SQL injection
db.query(`SELECT * FROM users WHERE email = '${email}'`);
// GOOD - parameterized query
db.query('SELECT * FROM users WHERE email = $1', [email]);
Use ORMs (Prisma, Drizzle) that handle parameterization automatically.
XSS Prevention
Escape user input when rendering:
// React escapes by default
<div>{userInput}</div> // Safe
// Dangerous - avoid unless absolutely necessary
<div dangerouslySetInnerHTML={{__html: userInput}} />
If you must render HTML, use a sanitization library like DOMPurify.
CSRF Protection
Cross-Site Request Forgery tricks users into making unwanted requests.
•
Use CSRF tokens for state-changing requests
•
Use SameSite cookies
•
Most frameworks include CSRF protection—enable it
Rate Limiting
Protect against brute force and abuse:
import rateLimit from 'express-rate-limit';
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // limit each IP
});
app.use('/api/', limiter);
Apply stricter limits to sensitive endpoints (login, password reset).
Access Control
Use Google Workspace on Your Domain
Set up Google Workspace on your project’s custom domain and create every employee and shared account there (for example, name@yourstartup.com). Don’t let critical tools end up owned by personal Gmail accounts.
Why this matters:
•
Ownership stays with the company, not the individual
•
Admins can enforce MFA, reset passwords, and revoke sessions
•
Offboarding is clean when someone leaves
•
Shared aliases and groups (founders@, billing@, security@) survive role changes
Use those domain accounts for GitHub, cloud providers, Stripe, banking, analytics, support tools, and anything else that controls customer data or money. Migrating later is annoying and error-prone; do it from day one.
Principle of Least Privilege
Users, services, and systems should have only the access they need:
•
Admin features only for admins
•
Database users with minimal permissions
•
API keys scoped to specific operations
•
Third-party integrations with limited access
Authorization Checks
Always verify the user can access the resource:
// BAD - trusting user input
app.get('/user/:id/data', async (req, res) => {
const data = await db.getUserData(req.params.id);
res.json(data);
});
// GOOD - verifying authorization
app.get('/user/:id/data', async (req, res) => {
if (req.user.id !== req.params.id && !req.user.isAdmin) {
return res.status(403).json({ error: 'Forbidden' });
}
const data = await db.getUserData(req.params.id);
res.json(data);
});
IDOR (Insecure Direct Object Reference) is one of the most common vulnerabilities.
Audit Logging
Log security-relevant events:
•
Login attempts (success and failure)
•
Password changes
•
Permission changes
•
Access to sensitive data
•
Admin actions
Logs help you detect and investigate incidents.
Infrastructure
Keep Dependencies Updated
Vulnerabilities in libraries are common. Update regularly:
npm audit
npm update
Use Dependabot or Snyk to automate vulnerability alerts.
Use Managed Services
Managed databases, hosting, and infrastructure handle security patches, backups, and configuration. Unless you have specific expertise, managed services are more secure than DIY.
Backup Everything
•
Automated daily backups
•
Backups stored in separate location
•
Regular backup restoration tests
•
Encryption of backup data
Firewall and Network
•
Restrict database access to application servers
•
Use VPCs for production infrastructure
•
Keep admin interfaces off public internet
•
Use allowlists for sensitive systems
Incident Response
Have a Plan
Before something happens, know:
1.
Who’s responsible for security incidents?
2.
How will you communicate internally?
3.
How will you communicate with users?
4.
What are your legal obligations (breach notification)?
5.
Who do you contact (lawyers, PR, affected users)?
Incident Steps
1.
Contain – Stop the bleeding. Revoke access, disable compromised systems.
2.
Investigate – What happened? What was accessed?
3.
Remediate – Fix the vulnerability. Reset credentials.
4.
Communicate – Notify affected users and relevant parties.
5.
Learn – What can you do to prevent this?
Breach Notification
Many jurisdictions require notifying users of data breaches. Know your obligations (GDPR, CCPA, state laws).
Security Checklist
Start here:
•
[ ] Using managed authentication service
•
[ ] HTTPS everywhere with HSTS
•
[ ] Secrets in environment variables, not code
•
[ ] Parameterized database queries (no SQL injection)
•
[ ] User input escaped in templates (no XSS)
•
[ ] Authorization checks on all endpoints
•
[ ] Rate limiting on sensitive endpoints
•
[ ] MFA available (required for admins)
•
[ ] Dependencies regularly updated
•
[ ] Backups automated and tested
•
[ ] Audit logging for security events
Resources
•
OWASP Top 10 – Most common vulnerabilities
•
OWASP Cheat Sheets – Specific guidance by topic
•
HaveIBeenPwned – Check for breached credentials
•
Security checklist generators – SOC2 prep tools
Key Takeaways
•
Use managed auth—don’t build it yourself
•
Encrypt data at rest and in transit
•
Validate and escape all user input
•
Always check authorization—don’t trust user input
•
Keep dependencies updated
•
Have an incident response plan before you need it
•
Security basics take hours to implement, not weeks—do them now
AIMake has access to all of this
Our AI has access to the entire Startup Handbook. Ask it anything about building your startup.
Get started →
← Previous
Prioritization Frameworks That Actually Work
Next →
Shipping Weekly: The Cadence That Wins