If you ever (have to) ask yourself “When is the right time to address security issues?”, you’re already late to the party. Security isn’t that layer that you just add on top of your application before shipping it to production. Security is a mindset, that constant voice inside your head which asks “Is this safe?” each time you code something that pulls data out of storage or changes structures based on a user’s action.