Ask HN: Handling Security as a Solo Dev?
3 cosmic_cheese 4 7/31/2025, 5:46:31 AM
There’s a project that’s been on mind my mind lately. I think I can ship an MVP reasonably quickly, but concerns about security have been holding me back.
There’s so many different ways to screw up, depending on how the app is developed and deployed (an old style VPS deployment is a very different beast than something e.g. deployed on Vercel using S3 and Supabase), and I’m most experienced in mobile client dev (haven’t touched back end since ~2012) which makes for considerable blind spots. I’m aware of basics like not checking in API keys and secrets, but I’m sure there’s a laundry list of things I’m not considering.
What’s the best way to make sure my bases are covered here? It used to be that using well vetted, battle tested tools like up to date Rails w/Devise would take you a long way, is that still true?
Thanks, and apologies if the question is too vague.
After deployment: There was a post on HN some days back regarding a tool that you can deploy on your machine to check for common misconfigurations and you can potentially scan the logs to discover issues. Also, I have developed an AI agent to act as a penetration tester (without the knowledge of your codebase or internal system) and discover vulnerabilities. I have been improving it since last year and using it to continously pentest my infra. I'm thinking of opening this up for others. Let me know if you need access to this.