Most startup founders think seriously about security around the time they're filling out a customer security questionnaire and realise they can't answer half the questions. The goal of this guide is to help you build a security baseline before that moment.
What you actually need to protect
Start by thinking about your actual threat model, not the theoretical one:
- Your code: Vulnerabilities that let attackers bypass auth, inject commands, or access data they shouldn't
- Your dependencies: Third-party packages with known CVEs that give attackers a foothold
- Your secrets: API keys, database passwords, OAuth credentials that give attackers access as you
- Your infrastructure: Exposed services, open ports, misconfigurations that create attack surface
- Your data: Customer PII, financial data, anything regulated
A startup at seed stage with 5,000 users needs a very different security posture than a Series B company processing payments. But both need the basics.
The minimum viable security stack
Layer 1: Code security ($0)
BattleTest: Automated PR security reviews on public and private repositories. Catches CVEs, secrets, injection flaws, and config issues on every PR. Public repos get 20 in-depth reviews an hour; private repos get 10 a month, then lighter scans.
If you outgrow those limits: connect your own model API key and the cap disappears — reviews run at full depth, with the inference billed by your provider rather than by us. There is no paid tier to upgrade to.
This single tool replaces: a secret scanning tool, a dependency scanner, a SAST tool, and a basic pen test — for teams under 5 people.
Layer 2: Authentication hardening ($0)
- Use a managed auth provider (Auth0, Clerk, Supabase Auth) — don't roll your own session management
- Enforce MFA for all admin accounts and your cloud provider accounts
- Use separate AWS/GCP accounts for prod and dev — breach of dev shouldn't mean breach of prod
- Rotate your API keys quarterly, or use short-lived credentials (AWS IAM roles, OIDC)
Layer 3: Infrastructure hardening ($0)
- Enable WAF on your cloud load balancer (AWS WAF / Cloudflare) — free for basic rules
- Set security headers on all HTTP responses (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
- Enable VPC with private subnets — your database should not be reachable from the internet
- Enable CloudTrail / audit logging in AWS — you need this for incident response
- Turn on Dependabot for automated dependency upgrade PRs
Layer 4: Secrets management ($20/month or less)
- Doppler ($10/mo): Syncs secrets to your CI/CD and local dev — no more
.envfiles emailed around - AWS Secrets Manager (~$0.40/secret/month): For production secrets in AWS
- Keep secrets out of Git. Use gitleaks pre-commit hooks to detect them
Layer 5: Monitoring ($0–30/month)
- Enable Sentry for error tracking — many security incidents surface as unexpected errors first
- Set up CloudWatch / Datadog alerts for auth failure spikes, unusual data volumes, API error rate increases
- Subscribe to security advisories for your major dependencies (GitHub's security advisories)
Your total bill
| Tool | Cost | What it covers |
|---|---|---|
| BattleTest | Free | PR review, secret scanning, CVE detection, static analysis |
| Doppler | $10/mo | Secrets management |
| Auth provider (Clerk) | Free tier | Auth, MFA, session management |
| Cloudflare WAF | Free | Basic WAF, DDoS protection |
| Sentry | Free tier | Error tracking |
| Total | ~$10/mo |
What to prioritise if you have no budget at all
- Connect BattleTest to your GitHub repos — it's free and catches the most damaging bugs
- Add Dependabot to your repositories (GitHub, free)
- Turn on MFA everywhere, especially AWS root account
- Move secrets out of your codebase into environment variables
- Enable logging in your cloud provider
These five things cost nothing and protect against the most common attack vectors.