There is a lot of advice in this thread that doesn't actually address your circumstances, or is just bad. I recommend reading: 1. https://devd.me/log/posts/sta

There is a lot of advice in this thread that doesn't actually address your circumstances, or is just bad. I recommend reading: 1. https://devd.me/log/posts/startup-security/ https://devd.me/log/posts/startup-security/ - relatively short and prescriptive 2. http://scrty.io/ http://scrty.io/ - start with http://scrty.io/foundations http://scrty.io/foundations + https://medium.com/starting-up-security/you-dont-need-a-chief-security-officer-3f8d1a76b924 https://medium.com/starting-up-security/you-dont-need-a-chie... + https://medium.com/starting-up-security/starting-up-security-policy-104261d5438a https://medium.com/starting-up-security/starting-up-security...