Auth, secrets, backups, and least privilege still apply when the first version is small.
MVPs get attacked with the same opportunistic scans as large products. We ship TLS, hashed credentials, secret management, and role-based access even on the first public URL.
Backups that have never been restored are not backups. We test restore on staging before launch and write down who is paged if the site goes down.
Least privilege for cloud keys and admin panels prevents a single leaked token from becoming a company incident. Speed is not an excuse for open buckets.
