How do I secure an MVP before launching in India?
Key takeaways
- Publicly exposed databases and admin panels are the most common critical finding in pre-launch Indian MVP reviews, and they take hours to close.
- Secrets committed to a Git repository must be rotated, not just deleted, because repository history and clones keep the old value alive.
- CERT-In requires 180 days of log retention for internet-facing systems, so log and alert on authentication and administrative events from day one.
- The DPDP Act 2023 applies as soon as you collect personal data, so publish a privacy notice and record consent before the first sign-up.
- A pre-launch VAPT of an Indian MVP typically costs Rs 40,000 to Rs 1,20,000 and takes 4 to 7 working days.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should I check in the codebase before launch?
Five things, and you can do most of them in a day. First, secrets: search the repository and the commit history for API keys, database URIs, private keys and tokens, then rotate anything found and move it to a secrets manager such as AWS Secrets Manager, GCP Secret Manager or Azure Key Vault. Second, input validation and injection: every query should be parameterised, every file upload validated by type and size, and every user-supplied value rendered rather than executed. Third, authentication and authorisation: check for endpoints that skip auth, or that trust a client-supplied user id, which is the classic broken access control. Fourth, dependency risk: run a software composition analysis tool and fix anything with a known exploitable CVE. Fifth, secrets in the client bundle, which is where API keys end up in front-end JavaScript by accident.
What should I check in the infrastructure before launch?
Five checks on the cloud side. Confirm that no database instance, admin console or storage bucket has a public IP or a world-open policy. Confirm that every human and every service account has MFA, and that long-lived access keys have been replaced with short-lived ones. Confirm that secrets are encrypted at rest with a managed key, and that the key is not readable by the application role. Confirm that logs are being shipped somewhere outside the host, with 180-day retention, because logs on the compromised machine are logs the attacker controls. And confirm that the staging environment is not a copy of production with production data in it, since staging is usually the least protected surface you have.
What about third parties and the MVP's own front end?
Your MVP probably embeds things you do not control: a payment page, a chat widget, a analytics script, a maps SDK, a font CDN, a heatmap tool. Each is a third party with access to whatever you pass it, which may include customer data. Audit the list, remove anything you cannot name a business reason for, and be strict about what you pass: never send a full customer record to an analytics or chat tool, and pass a hashed user id rather than an email address. For payment data, use the provider's hosted fields so the card number never touches your server, and keep the UPI or card reference token only. If a script is genuinely needed, self-host it or pin the exact version.
When should I get an external test, and what should it cover?
Before launch, and it should cover the authenticated product. A pre-launch VAPT of an Indian MVP usually runs 4 to 7 working days, with a retest of fixes included in the quote, and costs Rs 40,000 to Rs 1,20,000 depending on how many roles and endpoints are in scope. Ask for authentication testing, business logic testing, and an explicit check of tenant and object-level authorisation, because access control is where MVPs fail and where automated tools are weakest. Also ask for the report to note anything you must fix before the launch date, and take the findings seriously: a critical access-control finding in a product about to accept real customer data is worth delaying the launch for.
| Check | How to verify | Typical effort |
|---|---|---|
| MFA on code, cloud and admin | Attempt sign-in without a second factor | 1 day, configuration only |
| Secrets removed and rotated | Search repository and history for keys | Half a day plus rotation |
| No public database or bucket | Run nmap and check IAM policies from outside | 2 hours |
| API auth, rate limits, validation | Try the endpoints with a script | 1-2 days |
| Third-party scripts reviewed | List every script tag in the front end | Half a day |
| Logs retained 180 days | Check log store retention setting and a sample event | 2 hours |
| External pre-launch test | Scoped VAPT with authenticated roles | Rs 40,000 - Rs 1,20,000 |
What are the frequently asked questions?
Get a straight answer on this
Send us the launch date and the MVP's URL or staging environment, and we will fit a scoped pre-launch security test around it.
Send us the details See pricing