Yeah. Zero trust for all systems, including your own. You need TLS and Auth, preferably the users Auth if the app requires that. But also, assume it will hap

Yeah. Zero trust for all systems, including your own. You need TLS and Auth, preferably the users Auth if the app requires that. But also, assume it will happen so use some auditing and alerting capabilities to detect. Review the code you're trusting, or at least look at who's shipping it so you know what your trusting ( random individual / reliable group ). Scan as many dependicies you have, so you're aware of these rather than just luckily reading it on hacker news. All this is really just the MVP.