You do not need a large security team to ship secure software. You need a few consistent practices, applied from the first commit. Here is a practical checklist we use as a starting point.
Code and dependencies
- Require code review on every change.
- Run automated dependency and vulnerability scanning in CI.
- Keep frameworks and libraries up to date.
- Never commit secrets; use a secrets manager or environment variables.
Authentication and access
- Use a proven identity provider or well-maintained library, not a home-grown login.
- Enable multi-factor authentication for admin and developer accounts.
- Apply least-privilege roles for people and services.
- Remove access promptly when someone leaves the project.
Data protection
- Encrypt data in transit (TLS) and at rest.
- Collect only the personal data you actually need.
- Back up regularly and test restores.
- Log access to sensitive data.
Application basics
Validate and sanitise input, use parameterised queries, set secure HTTP headers, rate-limit sensitive endpoints, and handle errors without leaking internals. These simple measures address a large share of common web vulnerabilities.
Be ready for the bad day
- Monitor logs and set alerts for unusual activity.
- Write a short incident response plan: who does what, and who to notify.
- Rehearse it once so it works under pressure.
Security is cheaper to build in than to bolt on.
