Tools & processes · 2 min read
Staying secure
Security is everyone's job, not just engineering's. The basic habits we all keep so one careless moment doesn't become a breach.
The most common way into a company isn't clever code, it's a reused password or a convincing email. Security here isn't only an engineering concern (the product and code side lives in security); it's a set of habits everyone keeps. The weakest link is usually a real person having a distracted day, and that could be any of us. That's why the basics below aren't optional.
The basics
- A password manager, and a unique strong password for everything. No reuse, ever. This one habit shuts the most common door.
- Two-factor auth on everything that offers it, ideally an app or a hardware key rather than SMS.
- Keep your devices locked, encrypted, and up to date. Updates are boring and they're also how most holes get closed.
- Least access. You get access to what the work needs, you ask when you need more, and we take it away when you don't. Standing access you're not using is just risk sitting around.
Phishing and social engineering
Assume someone will eventually try to trick you, because eventually someone will. Be suspicious of manufactured urgency ("do this right now or else"), of unexpected links and attachments, and of anyone asking you to move money, hand over a credential, or read back a code. When something feels off, slow down and check in the open. Reporting a suspicious message is never overreacting; we'd rather see ten false alarms than miss the one real one.
Handling data and secrets
- Customer data is a responsibility, not a resource. Touch it only when the work genuinely needs it, don't copy it around, and don't paste it into random tools.
- Secrets never go in code, chat, or a doc. Keys, tokens, and credentials belong in proper secret storage. If one leaks, rotate it immediately and say so. A leaked secret caught and rotated fast is a non-event; one quietly hidden is how a breach starts.
If something goes wrong
If you think you clicked the wrong thing, leaked a credential, or lost a device, tell us immediately and in the open, however embarrassing it feels. There is zero blame for reporting fast, and it is the single most useful thing you can do. The only unforgivable move is going quiet and hoping it's fine. A quick heads-up usually turns a scare into a shrug; incidents covers what happens from there.