Actually to handle security is very hard. I think startups usually can't handle security as a process because time is little, stress in implementing features high and so on, so the best founders can do is probably to have security-aware programmers and try to don't introduce too much bugs.
Then if/when you become a mainstream site start doing planned security auditing from time to time.
Then if/when you become a mainstream site start doing planned security auditing from time to time.