Don't try to cover everything. Think about the critical risks for your startup - maybe it's cost-exhaustion attack, maybe it's leaking sensitive personal info,

Don't try to cover everything. Think about the critical risks for your startup - maybe it's cost-exhaustion attack, maybe it's leaking sensitive personal info, it depends on what you're doing. Then find reasonable protections to put in place for them.