Security-first product development