Hacker News Launch Security Checklist: 12 Items Before Posting

January 2026Launch Security

TL;DR

HN readers are technically savvy and will probe your app. Before posting your Show HN, hide sensitive endpoints, verify your error messages don't leak info, prepare for the "hug of death" traffic spike, and have a plan for handling security reports from the community.

Technical Scrutiny Prep 4

Hide admin and debug endpointsHN users will try /admin, /debug, /.git, /api/docs, etc.

Check error messagesStack traces, database errors, and config details should be hidden.

Review HTTP headersRemove server version info. Add security headers.

Test robots.txt and sitemapDon't accidentally expose sensitive URLs.

Traffic and Performance 4

::checklist-item{label="Prepare for the "hug of death"" description="HN front page can send massive traffic. Can you handle it?"} ::

Enable aggressive cachingStatic pages should be cached. Use a CDN.

Set up rate limitingProtect against scraping and abuse.

Have a static fallbackIf the app goes down, show a simple landing page.

Community Response 4

Prepare for security reportsHN users will find issues. Know how to receive and respond.

Add security contact infosecurity.txt or contact email should be easy to find.

Be ready to respond quicklyMonitor comments. Fix reported issues fast.

Don't get defensiveAccept valid criticism gracefully. HN respects humility.

Will HN users try to hack my app?

Yes, in a friendly way. The HN community includes security researchers who will check for obvious issues. They'll report them in comments or privately. This is actually helpful, but embarrassing if your app has basic flaws.

How much traffic does the HN front page bring?

A front page post can bring 20,000-100,000+ visitors in a few hours. The spike is intense but short-lived. Most small apps struggle to handle it without preparation.

Scan Before Your Show HN

Find issues before HN commenters do.

Start Free Scan

Launch Security