Ask HN: Handling Security as a Solo Dev? | Hacker News Reader

Ask HN: Handling Security as a Solo Dev?

3 pointscosmic_cheese4 comments

There’s a project that’s been on mind my mind lately. I think I can ship an MVP reasonably quickly, but concerns about security have been holding me back.

There’s so many different ways to screw up, depending on how the app is developed and deployed (an old style VPS deployment is a very different beast than something e.g. deployed on Vercel using S3 and Supabase), and I’m most experienced in mobile client dev (haven’t touched back end since ~2012) which makes for considerable blind spots. I’m aware of basics like not checking in API keys and secrets, but I’m sure there’s a laundry list of things I’m not considering.

What’s the best way to make sure my bases are covered here? It used to be that using well vetted, battle tested tools like up to date Rails w/Devise would take you a long way, is that still true?

Thanks, and apologies if the question is too vague.

Before deployment: Use tools such as codeql, sonarqube, etc. in your CI/CD pipeline. They scan the repo for known patterns and you can design your own patterns to automatically check before anything goes out.

After deployment: There was a post on HN some days back regarding a tool that you can deploy on your machine to check for common misconfigurations and you can potentially scan the logs to discover issues. Also, I have developed an AI agent to act as a penetration tester (without the knowledge of your codebase or internal system) and discover vulnerabilities. I have been improving it since last year and using it to continously pentest my infra. I'm thinking of opening this up for others. Let me know if you need access to this.

Don't try to cover everything. Think about the critical risks for your startup - maybe it's cost-exhaustion attack, maybe it's leaking sensitive personal info, it depends on what you're doing. Then find reasonable protections to put in place for them.

Hehe, We're still actively working on developing the features right now, so we haven't been able to fully address security concerns yet~

Write tests.

Reply on news.ycombinator.com