The Cybersecurity Checklist Every SaaS Company Needs Before Launch

We run a security review before every client launch, and across dozens of these reviews the same dozen gaps show up regardless of industry or team size. None of them require a dedicated security team to fix. Most require a day or two of focused engineering work. Here's the checklist, in the order we actually work through it.

Authentication and session handling

• Passwords hashed with bcrypt or argon2 — never MD5, SHA-1, or unsalted hashes
• Session tokens rotated on privilege changes (password reset, role change)
• Rate limiting on login and password-reset endpoints to block credential-stuffing attempts
• Multi-factor authentication available, even if not mandatory at launch
• JWT expiration enforced server-side, not just trusted from the client

The most common failure here isn't weak hashing — most teams get that right by default via their framework. It's missing rate limits on authentication endpoints, which turns a slow brute-force attack into a fast one.

Data protection

Encrypt data in transit (TLS 1.2+ everywhere, including internal service-to-service calls, not just the public-facing load balancer) and at rest (database-level encryption, encrypted backups, encrypted object storage). Then go one step further: identify which fields are actually sensitive — PII, payment details, health records — and apply field-level encryption or tokenization for those specifically, so a database dump alone doesn't expose your most sensitive data even if TLS and disk encryption are both compromised.

Access control

Implement the principle of least privilege at every layer: database roles scoped to what each service actually needs (not a single superuser connection string shared across your whole backend), cloud IAM roles scoped per service rather than one broad admin role, and application-level authorization checked on every request — not just hidden in the UI. We still find APIs where the frontend hides a delete button for non-admins, but the backend endpoint has no authorization check at all.

Infrastructure hardening

• Secrets stored in a secrets manager (AWS Secrets Manager, HashiCorp Vault, or equivalent) — never committed to source control or left in plaintext environment files
• Dependency scanning running in CI (Dependabot, Snyk, or equivalent) with a policy for how quickly criticals get patched
• Web application firewall or equivalent rate-limiting/DDoS protection in front of public endpoints
• Least-privilege network security groups — databases should never be reachable from the public internet

Logging and monitoring

You cannot respond to an incident you can't see. At minimum: centralized application logs with retention long enough to support an investigation (90 days minimum for most compliance frameworks), authentication event logging (successful and failed logins, password resets, permission changes), and alerting on anomalous patterns — a spike in failed logins, unusual data export volume, access from unexpected geographies.

Compliance basics, even before you need formal certification

If you're targeting healthcare, finance, or enterprise customers, you'll eventually need SOC 2, HIPAA, or PCI DSS compliance. Building toward these frameworks from day one — even informally — is dramatically cheaper than retrofitting them later. The habits that matter most early: documented data flow diagrams, a written incident response plan (even a one-page one), and vendor risk assessments for every third-party service that touches customer data.

The checklist we actually hand clients

For a first launch, we prioritize in this order: authentication rate limiting, secrets management, database network isolation, dependency scanning in CI, and centralized logging. These five items catch the highest-severity, highest-likelihood risks for the lowest engineering cost, and they're the five gaps our reviews find most often in pre-launch codebases — including ones built by experienced teams who simply hadn't gotten to security hardening yet because they were racing toward a launch date.

Security isn't a phase you complete before launch and never revisit — it's a standing engineering practice. But if you only have a week before your launch date and need to triage, this is the list that gives you the most protection per hour invested.