Security basics for your app

Most app security failures are not sophisticated. A password stored in plain text, a customer's order visible just by changing a number in the web address, an admin page with no login at all — these are ordinary mistakes, not clever attacks, and they show up again and again in apps built without a checklist for the basics.

Signs your app has gaps

• Nobody can tell you the last time the app's dependencies or libraries were updated.
• You are not sure whether a customer could see another customer's data by guessing or changing a URL.
• Passwords or payment details are stored without being properly protected.
• There is no record of who accessed what, so a suspicious access cannot be traced.

What good basics look like

Every password should be stored hashed, never in plain text. Every page that shows one customer's data should check that the logged-in user actually owns that data, not just that they are logged in at all. Inputs from users — a search box, a form field — should never be trusted directly into a database query. And sensitive actions, like changing an order or an admin setting, should be logged with who did it and when.

What it costs you

Building these basics in from the start costs very little extra — it is mostly discipline in how the code is written, not expensive tools. The cost goes up sharply if it is bolted on after a breach, along with the cost of customer trust, which is harder to rebuild than code. A small, honest security review before launch is far cheaper than a fix after something goes wrong.

Questions to ask any vendor

• Can you show me, concretely, how you prevent one customer from seeing another's data?
• Are passwords and payment details stored using accepted, published methods, not something invented in-house?
• Do you follow a recognised checklist, like the OWASP Top Ten, or just your own judgment?
• Is there a log of who accessed or changed sensitive data, that I can review?

How we can help

We build every app against a security checklist as a baseline, not an afterthought, and we can review an existing app you already have against the same list. Tell us about your app at /services, and when you are ready, start at talk to us.