Having someone on the team who understands security (can be a security engineer who also writes software, or a software engineer who also has some serious clue

Having someone on the team who understands security (can be a security engineer who also writes software, or a software engineer who also has some serious clue about security) should happen as early as possible. You will almost certainly need some form of authentication system in a couple places, and it doesn't take a lot to keep you from making the worst mistakes. Once you've build your entire (internal or external) auth system in a broken way, fixing it afterward is much more expensive, and you can expect to have weekly breaches while you do it. This doesn't need to be back-breaking (compare: WhatsApp), but it is avoidable.