Security Basics

Security isn't someone else's job. It starts with us.

Always

• Secrets in the vault, never in code, config files, Slack, or tickets. If a secret leaks, rotate it immediately and post in #incidents.
• Principle of least privilege for all access — services and humans.
• Dependencies scanned regularly, updated promptly for CVEs.
• PRs touching auth, crypto, or PII require two reviewers.
• Every change is reviewed against the security baseline: authorization per resource, injection, input limits, SSRF, uploads, headers, PII in logs. A High finding blocks the merge.
• Tokens and signing keys meet the token baseline.

Quarterly

• Access review: who has access to what, do they still need it?
• Dependency audit: anything unmaintained or risky?