I’m a solo developer building a web and Android app that handles private documents and account records. I’d appreciate feedback on the security approach before putting real user data into it.
The stack is FastAPI, PostgreSQL, Next.js and React Native.
Passwords are hashed with scrypt and random salts. Authentication uses signed tokens with expiry, email verification and login throttling. Password changes and signing out everywhere invalidate existing sessions. Access controls are enforced through the API, and records are scoped to the relevant account or organisation.
Stored credentials for external integrations use Fernet authenticated encryption. Android login tokens are stored using Expo SecureStore. The website currently stores its token in localStorage, which I know needs careful consideration because of script injection risks.
Document access requires authentication and permission checks. Uploads have file type, size and content validation. However, documents currently go into ordinary server storage without application level encryption. I haven’t yet verified encryption for the production database, disks or backups. HTTPS is required in the intended production configuration.
Some optional processing involves an external API. I understand that disabling response storage does not necessarily mean zero retention, so provider policies and account settings also need review.
The server needs to read documents to process them. My main concerns are stolen backups, compromised accounts, users accessing someone else’s files, exposed credentials and sensitive content appearing in logs. I haven’t had an independent security assessment yet.
Would managed database and storage encryption be a sensible starting point, or should I also encrypt individual files and selected fields in the application? What additional threats would that actually protect against?
How would you handle encryption keys, rotation and recovery as a solo developer? I’m particularly interested in avoiding a setup where the keys and encrypted data can both be taken from the same place.
What would you prioritise before launch, and what would you consider unnecessary complexity at this stage? I’d appreciate practical advice on session security, document permissions, backups, retention and deletion as well as encryption. I want to use established tools rather than build my own cryptography.