wtf is security-101-for-saas-startups?

This repository contains a guide for people working at early-stage software startups who want to know when and how to think about security. The author framed it as a collection of things they wished they had been told earlier in their career, written with the reality that startups have limited time and resources. The core question the guide addresses is which security concerns are worth tackling immediately and which can reasonably be deferred. The author argues that certain kinds of technical debt are fine to leave for later: for example, tightening up infrastructure configuration can wait until a funding round brings more budget and staff. But practices that shape team culture, like requiring code review before merging, are much harder to introduce later once people are used to working without them. The guide suggests thinking about several factors when deciding how much to invest in security at any given stage: what security questions paying customers are already raising, what the regulatory expectations are in your industry or target market, which policies your team would actually follow without resisting, and what the realistic impact of a data breach or theft would be for your specific business. The advice is organized around the stages a startup goes through, with the expectation that as a company takes on more customer data and revenue, the appropriate investment in security grows accordingly. Topics in the full guide include access control, data privacy, and breach planning. The README itself is short and links to the full security guide, which lives in a separate file in the repository. A Chinese translation is also available. No code is included in this repository.