Do you think about security while making your products? 🔑

When you are an early-stage startup, security might be forgotten. The main goal is to launch sometime fast and get the first users. Unfortunately, security is not on the checklist.

Yes, this is important to me as an internet security enthusiast. I do a lot of testing for XSS, CSRF, SQL injection, etc. security before publishing new features. I wouldn't focus too much on the design, as long as it's simple, fast, and useful. Design, UI/UX are just "Good To Have" for me. However, safety is always a must for me.

Absolutely. Security should be top of mind for anyone creating a product. I've tried to follow best practices, however I'm no security expert so interestingly enough I have a meeting with a friend today to review the security of my product. I actually plan on getting certified for my CMS SaaS. Apart from hardening your application, I think it's also important to be sensitive to personally identifiable information - if your application does not need additional information, it's best to not capture it. From a UX perspective this also keeps your forms simpler and avoids having a bunch of "optional" fields in your application. Great topic! Now I wonder who's going to address the importance of proper documentation? 🤔

Not as much as we should. Definitely not a part of the process like UX, UI, etc. Where should we start from?

For every founder who faced some security problems in the past, this becomes important. Otherwise, most founders & markets would not focus on it.

Indeed I have seen many products with obvious vulnerabilities and have always asked myself the same question. I've only developed 2 products in my life and for both of them were extremely important to get the security right (which is not easy or obvious at all!) For one of them, we hired an external company to make us a security audit and fixed all the vulnerabilities that were discovered. There is simply no way to catch everything as a developer so hiring an external company to do it is probably the easiest way to deal with this.

Interesting discussion. Bookmarked.

Security over design and adding functionalities anytime! If we don't handle it from the start it'll add up quickly and become to big of a task to come back to it. To a certain degree, Quality and Added Value of a product could come before because it starts with answering a need. But definitely security before launch

while we are making our product we didn't have a lot of resources i.e, money. Further we have used a lot open source software to speed up the development and reduce the cost, so we made a road plan about securing our website, it's really simple and as follows: 1: we scan our app everyday using some good scanner like zap 2: we keep track all of our open source for future vulnerabilities with https://vulert.com, in this way we don't have to worry about those software. I think this was most cheapest way for us to project security within our application. Best

I'm not a founder/maker myself (hope to be one day), but work for a very young startup. We've tried to build in good security practices from the beginning. Code reviews, open source code scanning, public vuln scanners, regular patching, scrutinising dependencies, group discussions about new high risk features, bug bashes, a security email alias for notifications, free secure code training, data minimisation. We're lucky that two of the co-founders are experienced engineers who are both very security aware. Application security is both hard and fun in my experience, especially with the fast pace of changes demanded of startups trying to gain new customers. I think it's about building layers of protection consistently over time. Just "thinking" about security is great because then you start to ask yourself questions and learn those answers. "Why do I keep seeing the acronym XSS on these free reports?", "There's a news article about a company I know being hacked because of something called a third party dependency". That knowledge builds up and hopefully sticks every time you make something new. Do you have a go to list of checks when building new things?

I would say yes. Even tho nowadays most of the implementation efforts are shifted to third parties so we (the developers) don't do stuff on our own. We just consume APIs. Even in my personal projects I tend to protect assets and user's data.