Building Strong Security Foundations: Lessons from Recent Incidents

Recent events in the indie hacking community underscore how vital solid security practices are, particularly for projects shared as starter kits or templates. These incidents reveal common vulnerabilities and offer valuable lessons for building secure, reliable SaaS applications.

In this article, we’ll explore the essential security practices that all SaaS developers should integrate from the start, with practical examples to secure key areas like payment processing, content access, and email webhooks.

The Risks of Rapid Development
Critical Security Measures for Payment Processing
Secure Access Management
Safeguarding Webhooks
Implementing a Testing-First Security Approach
Balancing Speed and Security in CI/CD
Final Takeaways

The Risks of Rapid Development

In indie development, speed is often prioritized. However, the mantra “move fast and break things” can introduce security gaps when unchecked, as recent events demonstrated. Striking a balance between quick iteration and robust security means integrating essential security practices right from the start.

The following examples illustrate key areas to address to prevent common vulnerabilities, especially in payment systems, user content access, and webhooks.

Critical Security Measures for Payment Processing

Handling transactions is a high-stakes area where even minor security oversights can lead to significant losses. Below, we’ll discuss vulnerabilities commonly found in payment workflows and best practices for securing them.

Vulnerability: Payment Success Validation on Client Side

A recent incident highlighted how client-side code exposing sensitive URLs can be exploited. Attackers could identify a visible “success” URL, bypassing the actual payment process entirely.

Solution: Server-Side Payment Validation

Always validate payments on the server side and use unique, time-sensitive tokens to track payment status.

Example: Server-Side Validation for Stripe Payment Success

// ❌ Risky Implementation
// Client-side validation exposes success URL in code
const stripe = Stripe('pk_test_xxx');
const checkout = await stripe.checkout.create({
  successUrl: window.location.origin + '/dashboard?userId=' + userId,
  cancelUrl: window.location.origin,
  // ...
});

// ✅ Improved Secure Implementation
app.get('/payment/success/:token', async (req, res) => {
  try {
    // Validate token and payment status, preventing reuse
    const paymentSession = await validatePaymentToken(req.params.token);
    const stripeSession = await stripe.checkout.sessions.retrieve(paymentSession.stripeSessionId);

    if (stripeSession.payment_status !== 'paid') {
      return res.redirect('/payment/failed');
    }

    await invalidatePaymentToken(req.params.token);

    const accessToken = await generateSecureAccessToken(stripeSession.customer);
    res.cookie('access_token', accessToken, { httpOnly: true, secure: true, sameSite: 'strict' });

    res.render('success');
  } catch (error) {
    console.error('Payment validation failed:', error);
    res.redirect('/payment/failed');
  }
});

Key Security Recommendations for Payment Systems

Server-Side Validation: Never rely on client-side URLs or parameters for verifying payment status.
Secure Cookies: Use HTTP-only, secure cookies for sensitive session tracking.
Audit and Monitor: Log all payment transactions and monitor for irregular patterns.

Secure Access Management

Ensuring that content access is well-guarded is another crucial area. Issues often arise when access is based on parameters that can be easily modified on the client side.

Vulnerability: Client-Side Parameters for Premium Access

In a recent example, access to GitHub repositories was based on unverified query parameters, allowing attackers to alter the request to access restricted content.

Solution: Access Verification and Secure Tokens

Ensure access control checks occur on the server, only after verifying user identity and purchase status.

Example: Securely Granting Repository Access

// ❌ Risky Approach
app.get('/grant-access', async (req, res) => {
  const githubUsername = req.query.username;
  await addUserToRepo(githubUsername);
  res.json({ success: true });
});

// ✅ Improved Secure Implementation
app.post('/grant-repo-access', async (req, res) => {
  try {
    const user = await getCurrentUser(req);
    const purchase = await Purchase.findOne({ userId: user.id, status: 'completed', productType: 'boilerplate' });

    const githubUser = await verifyGitHubUser(user.id, req.body.githubUsername);
    if (!purchase || !githubUser) return res.status(403).json({ error: 'Access Denied' });

    await addUserToRepo(githubUser.username);
    await logRepoAccess(user.id, githubUser.username);

    res.json({ success: true });
  } catch (error) {
    console.error('Failed to grant access:', error);
    res.status(500).json({ error: 'Error granting access' });
  }
});

Safeguarding Webhooks

Webhooks facilitate essential communication but can become an attack vector if unprotected. Without secure verification, attackers may send unauthorized requests, impacting email communications and compromising data integrity.

Vulnerability: Unverified Webhooks

Webhooks that don’t validate sender authenticity risk being exploited by attackers who can impersonate official systems or inject malicious content.

Solution: Signature Verification and Content Validation

Use hash-based verification and sanitize all inputs to secure webhooks against unauthorized access and malicious content.

Example: Secure Webhook Verification

const express = require('express');
const app = express();
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);


// ❌ Risky Implementation
app.post('/webhook', async (req, res) => {
  const { sender, content, subject } = req.body;
  await processEmail(sender, content, subject);
  res.json({ success: true });
});

// ✅ Improved Secure Implementation

// Use raw body parser for webhook signature verification
app.post('/webhook', express.raw({ type: 'application/json' }), async (req, res) => {
  const sig = req.headers['stripe-signature'];

  try {
    // Verify webhook signature
    const event = stripe.webhooks.constructEvent(
      req.body,
      sig,
      process.env.STRIPE_WEBHOOK_SECRET
    );

    // Handle different event types
    switch (event.type) {
      case 'payment_intent.succeeded':
        const paymentIntent = event.data.object;
        await handleSuccessfulPayment(paymentIntent);
        return res.json({ received: true });

      case 'payment_intent.payment_failed':
        const failedPayment = event.data.object;
        await handleFailedPayment(failedPayment);
        // Redirect to failure page with error details
        return res.redirect(303, `/payment/failed?error=${encodeURIComponent('Payment processing failed')}`);

      case 'customer.subscription.created':
        const subscription = event.data.object;
        await handleNewSubscription(subscription);
        return res.json({ received: true });

      default:
        // Handle unknown event types
        console.log(`Unhandled event type: ${event.type}`);
        return res.redirect(303, `/error?message=${encodeURIComponent('Unknown webhook event')}`);
    }
  } catch (err) {
    console.error(`Webhook Error: ${err.message}`);

    // Handle different types of errors
    if (err.type === 'StripeSignatureVerificationError') {
      return res.status(400).json({
        error: 'Invalid signature',
        message: 'Could not verify webhook signature'
      });
    }

    if (err.type === 'StripeInvalidRequestError') {
      return res.status(400).json({
        error: 'Invalid request',
        message: err.message
      });
    }

    // Generic error handler with redirect
    const errorMessage = encodeURIComponent(process.env.NODE_ENV === 'production'
      ? 'An error occurred processing the payment'
      : err.message);

    // Check if request accepts HTML (browser request)
    if (req.accepts('html')) {
      return res.redirect(303, `/error?message=${errorMessage}`);
    }

    // API response for non-browser requests
    return res.status(500).json({
      error: 'Internal Server Error',
      message: process.env.NODE_ENV === 'production'
        ? 'An error occurred processing the payment'
        : err.message
    });
  }
});

// Example handler functions
async function handleSuccessfulPayment(paymentIntent) {
  try {
    // Update order status in database
    // Send confirmation email
    console.log('Payment succeeded:', paymentIntent.id);
  } catch (error) {
    console.error('Error handling successful payment:', error);
    throw error;
  }
}

async function handleFailedPayment(paymentIntent) {
  try {
    // Update order status
    // Notify customer
    console.log('Payment failed:', paymentIntent.id);
  } catch (error) {
    console.error('Error handling failed payment:', error);
    throw error;
  }
}

async function handleNewSubscription(subscription) {
  try {
    // Provision access
    // Send welcome email
    console.log('New subscription:', subscription.id);
  } catch (error) {
    console.error('Error handling new subscription:', error);
    throw error;
  }
}

module.exports = app;

Implementing a Testing-First Security Approach

Skipping security testing to move faster can lead to vulnerabilities. Automated tests should cover:

Dependency Vulnerabilities: Regularly scan and update dependencies.
Penetration Testing: Run tests specifically focused on finding access or authentication gaps.
Session Management and Access Controls: Include testing for session handling and authorization.

Balancing Speed and Security in CI/CD

Integrating security checks into your CI/CD pipeline enables rapid development without sacrificing security. Examples include:

Dependency Scanning: Automated scans catch outdated or vulnerable dependencies.
Static Code Analysis: Detects code that could introduce security issues.
Audit Trails: Log user interactions to enable quick response if an issue arises.

Final Takeaways

The recent incidents highlight the importance of a robust security foundation when building a SaaS product. By addressing common vulnerabilities and following best practices in payment processing, content access, and webhooks, developers can protect both their users and their reputation.

A secure foundation ensures your application is equipped to scale and serve users without security risks lurking under the surface.