Most side projects never get a real security pass. Libero is what happened when I gave one to my own: a deliberate, adversarial security review of VolleyPacket, the live document-delivery SaaS I run, taken as seriously as a product that holds real people’s data deserves.
The approach
I started where an attacker would, with a full threat model of the system: what could go wrong at every trust boundary, from untrusted uploads and third-party providers to the multi-user data model and the AI features. Each risk became a written finding with a concrete fix, and each fix became a test that proves the hole is closed.
The security gate
The point was never a one-time cleanup. Every finding is covered by an automated check that runs in the build pipeline, so a change that reopens a closed risk fails the build instead of shipping. Security stops being something you remember to do and becomes a gate the code has to pass.
What it covered
The pass worked through the categories that actually break real apps: strict tenant isolation so no account can reach another’s data, guards against forged server-side requests and unsafe outbound calls, escaping and sanitizing everywhere untrusted input meets output, tighter authentication and transport rules, and hard limits so a single request cannot exhaust the system. Because the app runs AI over user-supplied spreadsheets, that also meant fencing untrusted rows out of the model’s instructions, treating prompt injection as a first-class threat.