How to protect my SaaS platform
Hi,
I have a developer building out a SaaS, this will be my first. My concern lies around avoiding any future hacking events, my developer stealing the platform when it gains traction etc. How do I take control of the platform once the developer has finished building and have superadmin access to avoid any wrong doing?
Thanks, I just don't know how this works on the back end when custom code, not as easy as handing over the reigns on a frontend Wordpress site for example.
You could try to contact some services like https://getsafesaas.co/ and get everything checked out.
Hi @tcurry999, as many pointed out there are different places you need to make sure it's secure and safe.
For all your third party apps, make sure you are using 2fa (hosting, servers, email, github/lab, etc).
Depending on how you set up your servers and all (if you are not using a third party solution for that), make sure to keep connections to databases private (using private networks instead of the public IP).
When I used to outsource my development, I always tried to double check the code and make sure nothing abnormal is left (you would need to understand the code in this case, and it can also be very hard if it's a huge project). Always look for the best practices of the technology the dev used, and make sure that all inputs are validated.
Hi @tcurry999, advice provide by @petrovn is quite detailed.
Here is a simplified take on how i would protect.
To put your mind to ease. Please note, Code is just one part of your business. Marketing, strategy, networking etc are the other parts that make your business successful, these are things that cannot be stolen but is a part of you.
Thanks
Shovan
it is very simple, first of all talk to your developers and try to get them involved (at least one of them) in the company (some shares or % at the end of the year) that will help having a long term relationship.
you need only the following to protect your SaaS from being hijacked in most cases
that is it, if possible you can give limited access account to your servers for deployment (or learn how to do the deployment yourself)
VERY IMPORTANT, there is no way (short of suing) to stop the developers to reuse parts of all of the code, so the way you protect it is by creating a brand so people know about you not someone else (you need to do this anyway to be successful). Developers are very bad with marketing and sales, if they where good at it, they will not waste time dealing with you but instead building one themselves.
when you hire developers or a company to build you something check out what else they are doing, you will reduce the chances of someone taking over your idea if they do not operate similar SaaS systems and are concentrated in providing development services.
Also to consider, capable software developer can register in your SaaS have a look around and copy all of your functionality, the actual coding is just $/hour, so anyone with money can copy your idea.
SaaS is not something you build once and you are done, it is a constantly changing service that needs to improve in what it is doing so it can continue making money, so you will need developers all the time, not just to build you the list of functionalities you have in mind now.
No root access, that's basic. Although there are ways to "escalate privilege" in windows and linux based machines.
Use SSH access with private key, don't use login/password access. Renew the private key once he's done. DigitalOcean got a lot of articles of how to do this.
If you got some budget and not too apt with coding, hire someone to do code review to catch the backdoors, if any.
Last and the most important, "own" your domain name. He can hack you, but I don't know how he can "steal" your SaaS if you got the domain name chained down.
Btw, hacking and programming are both very very broad topics. I have yet to see someone good at both.
Hire people you trust
Noted, thanks