SaaS Security Best Practices: The Developer's Implementation Guide

By Viprasol Tech Team

---

SaaS security is not a checklist you complete before launch — it's a set of practices that need to be embedded in how the application is built from day one. Retrofitting security is consistently more expensive than building it in. A data breach after launch is more expensive still.

This guide covers the security controls that matter most for SaaS applications: authentication, secrets management, input validation, the OWASP Top 10, dependency management, and the SOC2 controls that enterprise customers will eventually ask about.

---

Authentication and Session Security

Never Roll Your Own Auth

The authentication system handles the most sensitive part of your application. Building it from scratch introduces every class of authentication bug that has been discovered over decades of web development.

Use Clerk, Auth0, or Supabase Auth for managed authentication. If you must build it yourself (unusual):

• Passwords hashed with bcrypt or Argon2 (never MD5, SHA-1, or SHA-256 — too fast)
• Session tokens: cryptographically random, minimum 128 bits, stored hashed in DB
• Refresh token rotation: new token on every use; old token invalidated

JWT Security

import { SignJWT, jwtVerify } from 'jose';

const JWT_SECRET = new TextEncoder().encode(process.env.JWT_SECRET!);
// JWT secret must be minimum 256 bits (32 bytes) for HS256

async function signAccessToken(userId: string, tenantId: string): Promise<string> {
  return new SignJWT({ sub: userId, tid: tenantId, type: 'access' })
    .setProtectedHeader({ alg: 'HS256' })
    .setIssuedAt()
    .setExpirationTime('15m')   // short-lived — 15 minutes
    .setJwtid(crypto.randomUUID())  // unique jti for revocation
    .sign(JWT_SECRET);
}

async function verifyAccessToken(token: string) {
  try {
    const { payload } = await jwtVerify(token, JWT_SECRET, {
      algorithms: ['HS256'],
    });
    // Additional checks
    if (payload.type !== 'access') throw new Error('Wrong token type');
    return payload;
  } catch (err) {
    throw new Error('Invalid or expired token');
  }
}

JWT pitfalls to avoid:

• alg: none attacks — always specify algorithms in verification options
• Storing tokens in localStorage (XSS accessible) — use HttpOnly cookies for web
• Long expiration on access tokens — 15 minutes for access, 7–30 days for refresh
• Not validating iss, aud, exp claims on verification

Rate Limiting on Authentication Endpoints

import { Ratelimit } from '@upstash/ratelimit';
import { Redis }     from '@upstash/redis';

const ratelimit = new Ratelimit({
  redis:     Redis.fromEnv(),
  limiter:   Ratelimit.slidingWindow(10, '15 m'),  // 10 attempts per 15 minutes
  analytics: true,
});

app.post('/auth/login', async (req, res) => {
  const identifier = `login:${req.body.email}`;  // per-email rate limit
  const { success, reset } = await ratelimit.limit(identifier);

  if (!success) {
    res.setHeader('Retry-After', Math.ceil((reset - Date.now()) / 1000));
    return res.status(429).json({ error: 'Too many login attempts. Try again later.' });
  }

  // proceed with authentication
});

---

Secrets Management

Hardcoded credentials and secrets in source code are one of the most common causes of data breaches. GitGuardian scans public GitHub repositories and finds API keys in real time — attackers do the same.

The rule: No secrets in code, .env files committed to git, or environment variables stored in plaintext.

AWS Secrets Manager integration:

import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';

const secretsClient = new SecretsManagerClient({ region: 'us-east-1' });
const secretCache   = new Map<string, { value: string; expiresAt: number }>();

async function getSecret(secretName: string): Promise<string> {
  const cached = secretCache.get(secretName);
  if (cached && Date.now() < cached.expiresAt) return cached.value;

  const response = await secretsClient.send(
    new GetSecretValueCommand({ SecretId: secretName })
  );
  const value = response.SecretString!;

  // Cache for 5 minutes — avoids Secrets Manager API rate limits
  secretCache.set(secretName, { value, expiresAt: Date.now() + 5 * 60 * 1000 });
  return value;
}

// Fetch secrets at startup, not scattered throughout code
async function initializeApp() {
  const [dbUrl, stripeKey, jwtSecret] = await Promise.all([
    getSecret('production/db-url'),
    getSecret('production/stripe-secret-key'),
    getSecret('production/jwt-secret'),
  ]);
  // Initialize clients with fetched secrets
}

---

OWASP Top 10: The Critical Ones

SQL Injection — Parameterized Queries Always

// VULNERABLE: string interpolation in SQL
const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);
// Attacker input: '; DROP TABLE users; --

// SAFE: parameterized query
const user = await db.query('SELECT * FROM users WHERE email = $1', [email]);

// SAFE: ORM (Prisma, Drizzle — always parameterized)
const user = await prisma.user.findUnique({ where: { email } });

Cross-Site Scripting (XSS)

// React escapes JSX content automatically — this is safe
<div>{userContent}</div>

// DANGEROUS: dangerouslySetInnerHTML with user input
<div dangerouslySetInnerHTML={{ __html: userContent }} />  // Never without sanitization

// If rich text is required, sanitize with DOMPurify
import DOMPurify from 'dompurify';
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userContent) }} />

Content Security Policy prevents XSS by controlling what scripts the browser will execute:

// Express CSP middleware
app.use((req, res, next) => {
  res.setHeader('Content-Security-Policy', [
    "default-src 'self'",
    "script-src 'self' 'nonce-${res.locals.nonce}'",  // nonce for inline scripts
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: https:",
    "connect-src 'self' https://api.stripe.com",
    "frame-ancestors 'none'",     // prevents clickjacking
  ].join('; '));
  next();
});

Broken Object Level Authorization (IDOR)

// VULNERABLE: trusts user-supplied ID without authorization check
app.get('/api/documents/:id', async (req, res) => {
  const doc = await db.document.findUnique({ where: { id: req.params.id } });
  return res.json(doc);  // any authenticated user can access any document
});

// SAFE: ownership check before returning data
app.get('/api/documents/:id', requireAuth, async (req, res) => {
  const doc = await db.document.findUnique({
    where: {
      id:     req.params.id,
      userId: req.user.id,  // CRITICAL: scope to current user
    }
  });
  if (!doc) return res.status(404).json({ error: 'Not found' });
  return res.json(doc);
});

IDOR (Insecure Direct Object Reference) is consistently in the OWASP Top 10. Every query that returns user-specific data must include a user ownership check.

Mass Assignment

// VULNERABLE: spreading request body directly into database
app.put('/api/users/:id', async (req, res) => {
  await db.user.update({ where: { id: req.params.id }, data: req.body });
  // Attacker can set isAdmin: true, stripeCustomerId, planId, etc.
});

// SAFE: explicit whitelist of updatable fields
const UserUpdateSchema = z.object({
  name:   z.string().min(1).max(100).optional(),
  email:  z.string().email().optional(),
  avatar: z.string().url().optional(),
});

app.put('/api/users/:id', requireAuth, async (req, res) => {
  const parsed = UserUpdateSchema.safeParse(req.body);
  if (!parsed.success) return res.status(400).json({ error: 'Invalid input' });
  await db.user.update({ where: { id: req.user.id }, data: parsed.data });
  // Only the whitelisted fields can be updated
});

---

Dependency Security

Dependencies are the largest attack surface in modern applications. A compromised npm package (like the colors and faker supply chain incidents) can affect thousands of applications.

Automated vulnerability scanning in CI:

# .github/workflows/security.yml
jobs:
  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm audit --audit-level=high  # fail on high/critical vulnerabilities
      - uses: snyk/actions/node@master     # Snyk for additional SBOM scanning
        with:
          args: --severity-threshold=high
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  container-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t app:test .
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'app:test'
          severity:  'HIGH,CRITICAL'
          exit-code: '1'  # fail CI if vulnerabilities found

npm audit must run in CI and must fail builds on high/critical severity. This is non-negotiable for any application handling user data.

---

SOC2 Controls: What Enterprise Customers Will Ask For

SOC2 Type II is increasingly required for enterprise SaaS sales. The security controls that map to SOC2 common criteria:

Building these controls from day one takes 2–4 weeks of engineering time. Retrofitting them for a SOC2 audit 2 years later takes 2–3 months.

---

Security Headers Checklist

// Helmet.js for Node.js/Express — sets all security headers
import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: { directives: { /* ... */ } },
  hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
  noSniff: true,         // X-Content-Type-Options: nosniff
  frameguard: { action: 'deny' },  // X-Frame-Options: DENY
  xssFilter: true,
}));

Verify your headers at securityheaders.com — aim for an A rating before launch.

---

Working With Viprasol

Security is part of our development process, not an add-on. Every application we build includes: parameterized database queries, input validation with Zod, HttpOnly cookie session management, Secrets Manager for credentials, automated dependency scanning in CI, and CSP headers.

For clients targeting SOC2 or enterprise sales, we design the audit logging, RBAC, and encryption architecture from day one.

Our SaaS development services and web development practice include security-first implementation.

Building a secure SaaS application? Viprasol Tech implements security best practices for startups and enterprises. Contact us.

---

See also: SaaS Development Services · Enterprise Software Development · AWS Consulting Company

Sources: OWASP Top Ten 2025 · NIST Cybersecurity Framework · SOC2 Trust Service Criteria