Contract SaaS Development: How to ensure code security?
I am working on a web application; the project has moved further than ideation and I am actively pursuing developers to work on it.
The project would require integration with a payment gateway (stripe) and will include private keys for APIs.
My concerns are how to ensure the security of sensitive information like private keys; along with the confidentiality of the code base of the application if I am contracting other developers to work on my project?
Hi @SSG, I agree with @bfs. You'd usually have different keys for development, staging, and production and these should be stored and retrieved as environmental variables rather than hardcoded into the application source code. These could be shared via any of the secret managers mentioned.
Additionally, any devs working on your project should first be made to sign an NDA that covers your intellectual property and any other confidential information you deem necessary. This is usually enough of a deterrent in itself.
Best, Nigel
You don't want those keys to be in your source code. Ideally they should even be separate from your app configuration, and have documentation on how to rotate them in case of a breach. There should also be separate keys for development, staging, and production if you can.
Leakage of your source code should not be a world ender, if it is, then there may be something in your source code that should not be there.
Depending on how much access developers tend to have in production, the devs may only need access to the dev/test keys.
The most robust solution is to use a secret manager like Hashicorp Vault, Google Secret Manager, or the AWS equivalent.