APP SECURITY BY TYPE

Why “app type” matters more than “tech stack”

Two apps built on the same stack — say, Next.js + Supabase + Vercel — can have wildly different threat models depending on what they do. A SaaS that handles team collaboration cares about tenant isolation; an e-commerce app cares about checkout-flow integrity; a healthcare app cares about PHI exposure under HIPAA. The stack-level controls overlap, but the category-specific failure modes are what attackers actually go after.

This is especially true for AI-generated apps: the model knows how to scaffold a generic CRUD app, but the category-specific guardrails (escrow timing, PHI minimum-necessary access, financial reconciliation, content moderation) are rarely present in the first commit. They have to be added explicitly, with awareness of what kind of app you’re building.

Pick your category

Cross-cutting concerns (apply to most categories)

Regardless of category, every app needs these baselines — start with the free security self-audit and the vibe code scanner, then layer category-specific controls.

• Authentication and session integrity. No matter the category, a broken auth model means everything else is moot. Pair with the authentication implementation guide.
• Authorization beyond “logged in.” Authn says who you are; authz says what you can do. Most app-type-specific exploits are authorization failures — IDOR/BOLA on order IDs (e-commerce), tenant hopping (SaaS), patient record peeking (healthcare). See authorization patterns.
• Rate limiting and abuse protection. Different categories see different abuse: scraping (directory), credential stuffing (everything), enumeration (API). The mechanism is the same; the thresholds differ. See API abuse protection.
• Audit trails appropriate to the category. Healthcare and fintech mandate them; SaaS and marketplaces benefit; blogs and personal sites can skip. The right level depends on what regulators and incident-response teams will need.

How to use this hub

1. Read the page that matches your primary app type. If your app is two things (e.g. SaaS that processes payments), read both — combine the controls.
2. Map each finding in your app’s category guide to a backend control. Most reference backend-security sub-pages.
3. Run the free scans appropriate to your stack to verify what you implemented.
4. For regulated categories (healthcare, fintech), pair with the compliance checklist — the engineering controls map directly to the audit requirements.

Common cross-category mistakes

• Building “users” as a single concept across an obviously multi-role app. A marketplace has buyers, sellers, and admins; a SaaS has owners, members, and external collaborators. Treating them as one flat users table with a role column is the seed of every IDOR finding the category attracts.
• Trusting the client to enforce category-specific business rules. “The frontend hides the buy-now button if the listing is your own” is not a control. The backend has to refuse the action.
• Importing a category’s tech stack without its security posture. Copying a SaaS template into a healthcare context inherits the SaaS authn/authz patterns — which probably aren’t HIPAA-compliant. Stack-without-controls is half the work.
• Logging too much, monitoring too little. Categories with regulatory scrutiny (healthcare, fintech) need audit logs, not just debug logs. The first is a deliberate, structured, retained record; the second is whatever the framework dumped.
• Treating account recovery as an afterthought. “Forgot password” + “lost MFA device” is the highest-value attack surface in every category that has accounts. Most exploits route through there. Design it before you ship signup.

Related hubs

• Backend Security — the controls every category builds on.
• Deployment Security — the platform-level controls that wrap your app.
• Agentic Coding Security — extra controls when an AI agent wrote the code in this category.
• Safety Hub — platform-by-platform reviews (Lovable, Bolt, Cursor, etc.) that often determine your starting security posture.
• Compliance Checklist — concrete GDPR/SOC2/HIPAA control mappings.