3 Security flaws I find in almost every Hacker MVP (and how to fix them)

Hey Founders! 👋

I run an offensive security firm (SDX Shadow Labs), and we spend a lot of time pentesting early-stage startups and MVPs. I love the speed at which indie hackers ship, but I see the exact same 3 critical vulnerabilities in almost every new product.

If you are building an MVP right now, check your codebase for these:

1. The "Hidden" API Endpoint You built a feature, decided not to launch it, and hid the UI button. But you left the API endpoint live (/api/v1/export-users). Attackers don't need UI buttons; they just query your API directly. Delete dead code.

2. BFLA (Broken Function Level Authorization) Your user can only see their own dashboard, but what happens if they change their user ID in the HTTP request to admin_id? If your backend isn't double-checking authorization on every request, your data is exposed.

3. Trusting Client-Side Validation You disabled the "Submit" button in React if the user doesn't have credits. That’s UI, not security. Anyone can open Burp Suite or Postman and send the request anyway. Never trust the client.

What is the biggest security headache you've faced while trying to ship quickly? Let's discuss!