How do you actually secure a solo, AI-assisted SaaS? Left every API route unauthenticated for 3 weeks and want to do better.