TL;DR
Before going live: HTTPS everywhere, no exposed secrets, database security rules locked down, authentication tested, error handling that hides internals, and monitoring in place. 4 critical items must be fixed before launch, 8 important items within the first week, and 6 recommended items when you can. A breach on day one can kill your product before it starts.
Quick Checklist (5 Critical Items)
Transport Security 4
Security Headers 4
Data Security 4
Authentication and Input 3
Monitoring and Response 3
Launch Day Is Not the Time to Discover Problems
A security incident during your launch can kill momentum and destroy user trust before you even get started. Every item on this list is something that has caused real problems for real startups. The hour spent checking them is worth far more than the days spent recovering from a breach.
Run through this checklist thoroughly. Have someone else verify critical items. Launch with confidence that you have covered the basics.
What security checks are essential before going live?
At minimum: HTTPS with valid certificate, no exposed secrets, database security rules configured, authentication working correctly, input validation on all forms, and error handling that does not expose stack traces to users.
Should I get a security audit before launching?
A professional audit is ideal but expensive. For MVPs, use automated scanners, follow this checklist, and have a developer experienced in security review the code. Plan for a professional audit before scaling or raising funding.
What monitoring do I need for launch?
At minimum: error tracking (Sentry), uptime monitoring (UptimeRobot), and basic logging. Add application performance monitoring and security monitoring as you scale.