For a founding team
6 to fix · 10 you can skip
0 of 16 already hold at your size.
Close these now
- Move every key server-side and turn on secret scanning in the repo. Anything shipped to a browser is public.
- Enable row-level rules and write one policy per table. A single missed check in app code otherwise exposes every tenant.
- Replace any bespoke auth or crypto with a provider implementation. This is the one place generated code is never good enough.
- Put every prototype in version control and practise a rollback once, before you need it.
- Turn on MFA for admins and disable SMS as a factor. Mostly provider configuration, not engineering work.
- Add a pre-commit hook and editor linting so the feedback lands while the change is still in hand.
Safe to skip for now
- CI runs security checks that can block a merge — worth building around 10 engineers.
- Changes touching auth, money, or customer data get a human review before merge — worth building around 10 engineers.
- Every app has a named owner and a deprecation date — worth building around 10 engineers.
- Schema and migration changes go through a staging environment — worth building around 20 engineers.
- Dependency scanning catches hallucinated and typosquatted packages — worth building around 20 engineers.
- A formal secure-prompting and AI-risk training programme exists — worth building around 30 engineers.
- Prompt provenance is captured as metadata — model, prompt, parameters — worth building around 30 engineers.
- Internal and customer-facing production environments are separate — worth building around 30 engineers.
- Builders can pull from an internal catalog of pre-vetted security building blocks — worth building around 30 engineers.
- A multi-level assurance ladder calibrates review depth to risk — worth building around 30 engineers.