Security Checklist for a New Digital Product
You do not need a security department on day one. You do need a short list you will not skip.
/ Table of contents:
Identity first
Use a proven auth provider or a well-tested library. Hash passwords correctly. Turn on MFA for admins. Expire sessions. Do not roll your own crypto. If users can reset access by email, treat that inbox flow as part of the security surface, not a marketing detail.
Most leaks are not Hollywood hacks. They are a leftover admin account, a public bucket, or a secret in the repo.
/ Dimitriy Caliber
Data and secrets
Secrets live in the environment or a vault, never in git. Backups exist and you have restored one at least once. Customer files are not on a public URL. If you handle health or payment data, know which fields are sensitive and who can see them. Logging should not print tokens or personal data into Slack.
- HTTPS everywhere, including admin
- Least-privilege roles, not one god user
- Dependency updates on a calendar, not a mood
The product surface
Validate on the server. Rate-limit login and public forms. Hide detailed errors from strangers. If you have file upload, restrict type and size. If you have a public API, authenticate it. These are not “enterprise” extras. They are how you avoid becoming a headline for a boring reason.
A launch-week pass
Before go-live: rotate keys, check who still has production access, confirm backups, and walk through an account-deletion path if you collect personal data. After go-live: watch auth logs for a week. Security is a habit attached to delivery, not a PDF in a drawer.
Have a project in mind?
Leave your name and a way to reach you. We will get back with a clear next step.