Security Checklist for MVP Apps: What You Must Do Before Launch

"We'll add security later" is how data breaches happen. Even an MVP needs basic security. A single breach can destroy user trust and kill your product before it gains traction. Here's what you must do before launch.

---

Authentication Security

• Passwords hashed with bcrypt (cost factor 12+) or argon2
• HTTP-only cookies for session tokens (never localStorage)
• Secure and SameSite flags on cookies
• Password reset tokens expire after 1 hour
• Rate limiting on login (max 5 attempts per minute per IP)
• Rate limiting on signup (prevent spam accounts)
• Email verification before granting full access
• Session invalidation on logout (server-side, not just client)
• Minimum password requirements (8+ characters)

---

Data Protection

• HTTPS everywhere — no exceptions (free via Vercel, Netlify, or Let's Encrypt)
• Environment variables for all secrets (never hardcoded)
• .env files in .gitignore — never committed to version control
• No sensitive data in frontend code — check browser DevTools Network tab
• No sensitive data in error messages — don't expose stack traces to users
• Database connection via SSL in production
• Backups enabled for production database

---

API Security

• Input validation on all API endpoints (use Zod or similar)
• Authorization checks on every endpoint (verify user owns the resource)
• CORS configured to only allow your domain
• Rate limiting on all API endpoints
• No mass assignment — explicitly pick fields from request body
• SQL injection prevention — use ORM (Prisma/Drizzle), never raw SQL with user input
• XSS prevention — sanitize user-generated content displayed in HTML

---

Payment Security

• Stripe Checkout (hosted) or Stripe Elements — never handle raw card numbers
• Webhook signature verification — verify every Stripe webhook
• Idempotent webhook handling — handle duplicate webhook events gracefully
• Never trust client-side prices — always set prices server-side
• Test mode for development — never use live keys in dev environment

---

Dependency Security

• Run npm audit and fix critical/high vulnerabilities
• Lock dependency versions with package-lock.json or pnpm-lock.yaml
• Review new dependencies before installing (check npm weekly downloads, last publish date, GitHub stars)
• Remove unused dependencies
• Set up Dependabot or Renovate for automated dependency updates

---

Infrastructure Security

• No debug modes in production — remove console.logs with sensitive data
• Error tracking (Sentry) configured — catch errors without exposing them to users
• Proper HTTP headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options
• Admin routes protected — separate auth check for admin functionality
• File upload restrictions — if applicable, limit file types and sizes

---

The OWASP Top 10 Quick Check

---

Before You Go Live

Run through this abbreviated checklist:

1. Open your app in an incognito browser
2. Try logging in with wrong passwords 10 times — does rate limiting kick in?
3. Open DevTools → Network tab — is any sensitive data visible?
4. Check your deployed environment variables — are all secrets set correctly?
5. Make a test payment — does the webhook fire and complete correctly?
6. Try accessing admin pages without logging in — are they protected?
7. Run npm audit — are there critical vulnerabilities?

If all 7 pass, you're ready to launch.

---

Deploying soon? Read From Boilerplate to Production: Deployment Checklist.

Need a secure foundation? Browse security-hardened boilerplates on MVPHub.

---