Seeking app security advice

Great question and honestly one more founders should be asking before launch rather than after a breach. The general rule at this stage: don't pay for a manual pentest yet (way too expensive for MVP), but do run an automated scan. Tools like automated SAST scanners can flag your most critical issues, exposed secrets, missing auth checks, open database policies, in minutes and give you a prioritized fix list. The OWASP Top 10 is also free reading and covers 80% of what will bite you first. Try vouch-secure for free if you want, but I’m sure you might also find other tools.

Security is a very broad topic. It can range from using TLS on your hosting, to encrypting data in your data store to santizing your user input. I would say that it's something that works best if it's factored in from the outset during the design and build rather than being an afterthought.

As a startup you have to weigh up the cost and benefits. On one extreme you have a rock solid secure app that likely never gets released because you're never quite satisfied that it's secure enough. At the other end of the spectrum you might have a completely unsecured app that you begin rolling with without too much thought.

The question to ask is what exactly are you protecting and what will be the consequences for your users and your reputation if data is lost or stolen, sabotaged etc?

It really comes down to a discussion about the specifics on your project. As an example you've chosen Firebase Auth. There are two ways to use this product. The first is to call Firebase Firestore via within the client code (usually the browser) and have a set of security rules about which users can and can't access inside the Firebase project's control panel. The second way is to integrate Firebase Auth with a web API or set of Firebase Functions and keep your business logic on the server side. Each way has different security implications.

I would advise against hiring a random person from fiverr unless they've got some certification to backup their expertise.

Could you share more details about your project and how it has been built?

Completely agree with the comment of @BackendDev, and at the same time realizing that your professional focus is probably not on security, you may want to make use of various "checklist"-structured guides to make sure you didn't miss anything. For example, OWASP offers "testing guides" that provide a categorized list of security testing scenarios.

Do not rush to the solution, first outline the problem. What exactly are the risks associated with digital security in your case? What's the worst case scenario?

Once you figure out your problem, you can start figuring out your threat model using checklists. And stay pragmatic when implementing security responses.

If you work in a high-risk industry (healthcare, fintech) or you expect a lot of eyes of attackers on your app (e.g. a popular multiplayer game), then you want to have a professional take a look.

Hi.

Security for startups? Unless you already have a solid Security Workflow/Process/Partnership/Team/Funds, you can be reasonably sure you aren't secure. You ust on't have the overall ability to "know what you don't know you don't know"..

Oct20/23 -- okta -- security company.. serious traction. lots of knowledge.. hacked via their "support" process/vetctor" These dudes are multi billion market cap. Every other day a major company/operation/etc is hit. You simply don't hear about the vast majority of issues.

At the same time, you have to have everything locked tight to be secure. um.. Are you concerned about:

site access...
site access via user/login issues
site access due to some 3rd party API
system access via some error in a system update for the OS/some underlying piece of OS
some hardware issue in the data center/cloud instance you're running on?

data access
ability for someone to access your data.. all or part of it
what kind of access.. user data? finance data? site source code data? history data for the application?
can the redundant systems be corrupted in a manner you don't realize that could crash you if you rebuilt from the data?

security of your team members...
your team gets sloppy
your team rips you off

someone finds some information that allows them access to your system
are you able to "log/monitor" everything? what do you need to monitor/log/etc..

This could go on for a long time....

To be honest, Im not sure what the situation is/should be/could be for the startup that's starting out.

I know plenty do start and grow, and "claim" to now have had an issue.. I know of a lot less willing to discuss their security processes. -- why make themselves a vector without having to be one!

There are lots of forums/threads/email lists (I think) that you could dive into. But on the other hand, how much time do you have for this part of the operation?

The best "advice" I could provide. (No idea if this will or, or minimize the issue). Get on ycombinator.news (I think) -- it's a thread/list kind of thinkg.. if you haven't already been there.. and see if you can find someone/some things in this area, that you can tal with some skilled operators..

Also, get on LinkedIn, post the issues. Try to find "help/information". At the same time, might be possible to find a partnering operation that will handle part of this for you. But then, how can you really trust the "operation"!!

Bottom Line. The internet (thanks Tim Berners and the rest of the early guys!!) wasn't ever intended to be used for serious/secure data/finance/stuff.. All of the underlying/hardware/sys protocols have been jury-rigged to run on top of a slowly sinking maze of pipes...

If you could find an operation that you could "pay" to be your security arm, that could work.

I'll be in the same boat in a bit. And no, I have no clue as to how to solve this..

oh.. and as far as picking up the mobile/cell and riping off a call to actually talk to someone! yeah, that stopped happening eons ago...

hope some of this helps..

This may run contrary to the advice here, and caveat that I'm not a security expert so take this with a grain of salt, but I think that if you do follow Firebase's best practices and documentation around security, you are probably secure enough for the MVP stage. Firebase's documentation is very good, and they talk a lot about how to make sure your app is secure. I don't think you should pay for a security audit at this stage, it's too early. Maybe later down the road when you have actual revenue/customers.

Are you also using Firestore to store data? If so, having a good handle on security rules is important. That's probably the most likely source of vulnerabilities, not Firebase auth.

There is already some good advice here but my experience as a developer has been to never build my own security system if I'm going to be storing sensitive user/customer data. Always use a vetted and well-known security solution because large companies can afford to pay and employee people who are experts at this and by paying a monthly fee for that, you're saving yourself a bunch of trouble down the line.

You are definitely right about Security being a vast.

There are so many aspects to it; and ways to test and secure a product. I may reiterate parts of what was said above. Some of which include operational security (your people processes), application security (securing your product), infrastructure security (securing your hosting environments and networks).

But it sounds like you may be asking specifically about application/product secuity. The general concepts of application security are to:

1. Define what is important to secure (customer data?, your intellectual property?, etc.)
2. Implement controls to test and secure your product as it's developed
   • Source code security scans (sast)
   • Vulnerable Code Dependency scans
   • Source Code Credential Leaks
3. Implement controls to test and monitor a live running instance of the app
   • Penetration Testing
   • Dynamic Security Testing (DAST)

Pure coincidence, I just opened my SaaS for beta testing this week.
https://untamed.cloud

I can solve for all of the above. If you are interested, DM for more info. If you aren't interested in the service, DM anyways to chat security. Happy to help, and good luck. It's awesome that you are taking security this seriously early on.

Well, probably too late to help, but one way to think about the cybersecurity problem is to work within a framework that addresses security in a sensible way. One of the things I like about primarily working in WordPress is that a ton of security work has been done over the years. WP gets grief because WP sites are hacked with frequency, but 40% of the web runs on it, so the big numbers are a factor. Also, there are tons of people running outdated previous versions that they haven't patched, so of course they get hammered. But if you're up to date on WordPress, especially if you layer a couple of tools over the top of your install, is a lot more secure than anything you're likely to come up with yourself. That said, there are a couple of important general practices, perhaps the most important being to sanitize absolutely everything that could be input by a user. This includes things like cookies and profile settings...anything a user could touch, even if they wouldn't ordinarily do so.