Security for a web startup that handles sensitive data must be a concern from day one.  To think you can deal with security by simply following developing best practices is an utopia. You have to carefully plan and continuously run security tests. But this is not enough: it is the vulnerability detection and analysis methodology that determines the test effectiveness.