all 17 comments

[–]interactionjackson 3 points4 points  (1 child)

I see this a lot and i get it. Everyone sees the front end so this is where we put all of our people.

where is your ops team? how are you scaling? build, integration, and unit tests. automated deploys.

how often are you rotating secrets?

i like the idea of hiring a security team to audit things.

[–]The_Enigma231[S] 0 points1 point  (0 children)

These are all good questions.

I didn’t allocate an Ops team, as far as scaling the app I plan on running multiple instances. I’m using an SFTP connection for deployment and I have not actually established build, integration and unit tests. I’ve been so focused on delivering the product.

I haven’t rotated secrets (we aren’t fully live yet, but will be mindful of this)

Thank you so much for the feedback

[–]dmitry_murashenkov 1 point2 points  (1 child)

It would be nice to first list the actual work that should be done, then estimate it in man-days, add deadlines, then see how many people you need.

Also, the numbers don't tell much without context - for example you can hire dev for 3.5 years for 100k$ in some countries, while in the US it only would cover 1 year of salary tops.

In my experience - it is usually better when devs write the tests for their own code before it is shipped. But very few guys can actually do it and still for some tasks manual testing is required and just additional check won't hurt, so I'd include a QA guy just in case. He can also perform some basic ops activities.

If you are hiring and not contracting then you might get lucky and hire developer who is also well versed in security. Although security becomes a standalone concern these days - there isn't that much work there on the regular basis. Plan B is to contract pros for a quick one time security audit.

Also with team of 5+ people there will be more management overhead, so if you do it all by yourself - prepare to give up some other activities to free the time. Perhaps some of the team administration work can be offloaded to the QA guy, who can be sort of release manager, track deadlines and help coordinate the team effort.


Thank you so much for this information!

[–]tongboy 1 point2 points  (1 child)

Everyone seems so happy to tell you that you fucked up by not hiring 10 people to fix problems that didn't exist before.

Ignore all of them.

You absolutely did the right thing by proving you had a market that needed a product before dumping a pile of money building an ultra secure and resilient product that nobody wanted.

First off - good luck getting on-shore devs for those prices - unless you're hiring fresh newbies that aren't competent - which you don't want. Those aren't even salary numbers - let alone fully burdened numbers.

You probably don't have need for a fulltime DBA - I'd split that role - devops/deploys/security and automation/testing would probably be better. as your team grows you can better situate that.

I'd also strongly consider taking a few of those roles offshore - you can double those headcounts - onshore is great for leadership - I'd bring a frontend and backend lead on onshore and then have them manage off-shore resources - you'd have a lot more cash to bring a lot more head count on that way. then you could bring people on as you need them - do you have a QA/code coverage problem? add more people to that team? need more security? devops? bring those people on.

Your needs are going to ebb and flow strongly. good dev people are going to be able to generally cover writing code front and back side and some of the dev ops and DB stuff but experts are really going to be needed for security, DB and the tougher parts of QA and devops - better to have cash available to account for contractors in situations when you need them than trying to put heads on those. They just won't be full time jobs for the reasonable future.

The obvious pieces missing from your list - where is your designer and your PM? are you going to PM the team? If you hire right you can lean on leads to do it as well... it's getting a bit big to do that, personally I hate running down and nagging everyone for status updates... Also design is critical and that you DO need a full time head around to do all the time.


Thank you so much for all of this. I really like all the points you made. I really do need to consider getting a FT designer that is something that never gets communicated correctly.

[–]vnearhere 0 points1 point  (2 children)

Is the image intentionally a thumbnail size? it's very hard to read, even zoomed in.

Ideally your customers do testing for you because their feedback can help you guide according to their needs... Plus... free beta testers

[–]The_Enigma231[S] 1 point2 points  (1 child)

I updated the thumbnail, sorry about that.

And thank you for that feedback.

[–]vnearhere 3 points4 points  (0 children)

Thanks for updating the image. Looks good, but "scaling out" sounds very ambiguous and I would be wary of complicating things early on. Focus on having a working product and polishing it to all ends like a tablecloth at the royal dinner. Maybe you could use a team to scale it, but prioritize having a deliverable and scaling will be easy. Plus, taking investor money means they want to see results and junk, whereas if you focus on a product you can be self-funded and not need investor money, so it depends if you see a very high need to break into the market and wrestle into product/market fit before anyone else (critical!) then explain this in no uncertain terms, but "scaling out" doesn't really seem to justify external meddling

[–]BenAlexanders 0 points1 point  (5 children)

The short answer is yes. There should have been a security engineer in there from day 1. While not as good, starting today is better than nothing.

Also have you considered your compliance requirements? You'll no doubt be collecting PI, possibly CHD as well and working with minors in the Gov space... I'm surprised you are getting education approval without some sort of compliance certification (PCI SAQ A-EP, ISO, NIST... or atleast a penetration test, or vulnerability assessment). Do you know if you are compliant with CCPA, or need to be GDPR compliant for dual nationals?)

This is a cost to your startup, but is a huge marketing advantage when reaching out to new customers... Aside from preventing a security incident, any type of compliance breach will put you out of business almost instantly.

[–]The_Enigma231[S] 1 point2 points  (4 children)


We are partnered with Microsoft and I was told that compliance certifications would apply to us at that point since our web app is hosted there.

Is this just completely wrong? I looked in the list and GDPR is listed.

Do you have any suggestions for getting those compliance certifications?

[–]Physical_Accountant 1 point2 points  (1 child)

They make sure the hardware & networking is set up properly and there are locks & guards at the data center. Basically they guarantee that any security issues will not be because of them and 100% on you.

Jesus christ, what are your qualifications to manage this product? Where the fuck is the CTO?

You're going to be handling data of underage CHILDREN and you seemingly give 0 fucks about any quality anywhere.


I appreciate the, energetic feedback.

I graduated college and immediately got brought on to help my friend build a platform with no pay initially. I’m learning as I go and I’m doing this NOW instead of later.

I do really appreciate your comments though, because we should be worried about customers data and we are. That’s why I’m here asking questions to make sure I am doing everything right, instead of just assuming.

[–]BenAlexanders 1 point2 points  (1 child)

Your host is compliant, but you may still need to prove that your app is compliant as well.

The example I see a lot for PCI is a business that uses a compliant host (Azure, AWS, etc), and a compliant payment processor (PayPal, etc). They themselves have a vulnerability, or their third party has a vulnerability and the entire thing is compromised that way.

Look at the ongoing MageCart issue. Big companies like British Airlines, Ticketmaster, Newegg (or was it best buy?) all got hit, even though they had outsourced their payment portal. In the British Airlines case, they received a $300m fine from the privacy commissioner for not taking reasonable steps to ensure users data was secured (plus they may still have multiple more fines from PCI for the loss of customer credit card details, as well as GDPR for inadequate handling of European personal information, etc...). Google for the PCI SAQ A-EP which is the self assessment your website must meet, even if you are outsourcing the payment portal to an external third party.

You also mention GDPR, having a GDPR compliant host is a great first step. You also need controls in places to tag and govern the user data you have. You must ensure that you have fully explained why you are collecting their details, how it will be used, etc etc.

If an EU users came to you today and asked to have their data erased immediately, could you do that in a couple of days? For a small, internally built app, it should be possible... But have you tracked where else you have shared that data? Google probably has a copy of it from their web analytics running on your website. What about mailchimp for your email campaigns? Did you log their name to your centralised logging platform? How about your web app monitoring with their username? Are you communicating their details in Microsoft Outlook? What about these third parties you are using offshore, are they compliant and following these same rules?

... Could you track down and remove that users information from all of your systems, as well as your compliant and non compliant third parties in a matter of days? What if you have 100 different people ask to be forgotten on day 1?

That's just for the Europeans, are you aware of what your other requirements are for Californian residents?

This is all a big pill to take for a startup. I don't expect your MVP had these items included. You would be unlucky to get hit with any of these... But it is something you should have in your risk register and be considering to address.


This is great info thank you. The good thing is, that we don’t handle transactions on our website.

[–]Physical_Accountant 0 points1 point  (1 child)

Hiring a security expert after the code is written is like an autopsy. He can tell you where you've fucked up but it's too late now and you're not going to rewrite everything from scratch.

Security cannot be implemented as an afterthought. It's not a module you attach to your code. It's something that should have been there from the drawing board.


I agree, but it wasn’t. So I’m trying to figure it out now instead of focusing on not having it from the start.