Security basics every SaaS founder ignores
MFA on the cloud console, secrets out of git, backups you've actually restored — the unglamorous checklist that outperforms every vendor pitch.
We hold data about children — names, photos, attendance, which gate they leave from and when. That sentence should terrify every EdTech founder, and it's why I have little patience for security theater. The uncomfortable truth from a decade of running SaaS and auditing other people's: nobody gets breached through the fancy stuff. It's always the basics.
The unglamorous checklist that actually matters
- MFA on the cloud console. Your AWS root account with a reused password is a company-ending event waiting for a leak dump.
- Secrets out of git. Once a key touches a commit, it's compromised — history is forever. Rotate it; don't rewrite and hope.
- Least privilege, boringly enforced. The support intern does not need production database access. Neither, honestly, does the CTO on a Tuesday.
- Dependency updates on a schedule — the exploited vulnerability is almost always one with a patch that shipped months ago.
- Backups you have actually restored. An untested backup is a hope, not a plan. We restore into staging quarterly, and the first attempt taught us why.
Attackers don't break in through the wall you reinforced. They walk through the door you forgot you left open.
Culture beats tooling
The cheapest security control we ever shipped was making it safe to report a mistake. An engineer who pushes a key to a repo and says so within five minutes is a hero; the same mistake hidden for a month is an incident. Blameless reporting, a fifteen-minute rotation runbook, done. No vendor sells that, and it outperforms everything they do sell.