The code is tested, the UI is polished, and the domain is live. If your security plan is an SSL certificate and a hope that nobody looks closely at your API, you aren't launching a product. You're launching a liability.
Stolen credentials started 22% of breaches in Verizon's 2025 report, and exploited vulnerabilities another 20% (Verizon, 2025). Security works in layers: when one fails, the next one catches the attacker.
Six layers, one request
- 1Edge stops bots and floods
- 2Identity stops stolen passwords
- 3Input stops injection
- 4Access stops reading others' data
- 5Data and secrets limit the damage
- 6Monitoring watches every layer
1. Edge: stop the noise
Redirect HTTP to HTTPS and send the Strict-Transport-Security header, so
browsers upgrade every later request to HTTPS (MDN, 2026). Put a web application
firewall (Cloudflare, AWS Shield or your cloud's own) in front, and rate-limit login,
password reset and expensive APIs.
2. Identity: trust no one
Keep session tokens in HttpOnly, Secure, SameSite cookies.
OWASP warns that one cross-site scripting bug can read everything in local storage
(OWASP, 2025). Hash passwords with Argon2id, and make multi-factor login mandatory for
every admin.
3. Input: never trust the client
Parameterise every query. Encode user content for the context it renders in. Encrypt sensitive data at rest and in transit.
4. Authorisation: check every object
OWASP ranks broken access control first and found some form of it in every application it tested (OWASP, 2025). If user A asks for invoice 104, the server checks that A owns it. Re-validate prices and permissions on the server.
5. Secrets and infrastructure
GitGuardian detected 28.6 million new secrets in public GitHub commits in 2025 (GitGuardian, 2026). Keep keys in a secrets manager, give the app's database user only the rights it needs, and run containers as non-root.
6. Logging: know when you're hit
Log failed logins, permission denials and privilege changes, never passwords or tokens. Show users a generic error, not a stack trace. In India, CERT-In requires reporting covered incidents within 6 hours and keeping logs for 180 days (CERT-In, 2022).
The pre-launch check
Score each 0 (no), 1 (partly) or 2 (yes):
- HTTPS enforced, with HSTS.
- Every query parameterised.
- Tokens in
HttpOnlycookies, not local storage. - Rate limits on login and costly routes.
- Zero secrets in the repository.
- Database and cloud roles at minimum privilege.
| Score | Next move |
|---|---|
| 11–12 | Launch, and schedule a review in three months. |
| 7–10 | Close the gaps before real users arrive. |
| 0–6 | Don't launch yet. |
Your next step
Before your next release, run a secret scanner over your whole Git history, not just the latest commit. A key deleted last month is still in it.
Sources
- Verizon (2025). 2025 Data Breach Investigations Report. News release, 23 April 2025.
- MDN (2026). Strict-Transport-Security. MDN Web Docs.
- OWASP (2025). A01:2025 Broken Access Control; HTML5 Security Cheat Sheet; Password Storage Cheat Sheet.
- GitGuardian (2026). The State of Secrets Sprawl 2026.
- CERT-In (2022). Directions under section 70B(6) of the IT Act, 2000. 28 April 2022.