Security basics that fit in a week

Everything below fits inside a normal week, alongside the work you already owe someone. None of it needs a new hire. Start at the top.

The access list grows with every contractor, every integration, every emergency. Most teams grant access once and never take it back. Nobody prunes it.

Give a person the access their work needs, and no more. Write down who has admin on email, the registrar, the cloud account and the payment tools. That page is the exercise.

Shared passwords live in chat threads and spreadsheets until someone leaves. A manager puts them in one place, controls who can open each item, and lets you rotate them the day somebody goes. Buy it for the whole team.

It is that you can rotate them, and see what a leaver can still open. The point is not stronger passwords.

A session cookie is the key to the account once the password is done. A few flags decide how safely it travels.

• HttpOnly — scripts on the page cannot read the cookie.
• Secure — the cookie only travels over an encrypted connection.
• SameSite — limits when another site can make the browser send it. Use None only where a cross-site flow needs it.

Expiry matters as much as the flags. A session that never ends turns one borrowed laptop into standing access. Sign people out.

Most of the code in your product was written by somebody else. The risk sits in the gap between a published fix and an installed one. Updates arrive constantly.

Pin your versions, read the changelog and keep the build reproducible. A weekly slot beats a heroic quarterly upgrade.

The day somebody leaves is the day the access list gets tested. Write the list once, and follow it every time.

• Email, calendar and files — suspended, then handed over.
• The password manager seat removed, and the shared items rotated.
• SSH keys, API tokens and personal access tokens, revoked.
• Cloud, registrar, payment and analytics accounts, checked by name.
• Devices returned or wiped, with a note of which is which.

Run the same list for a contractor, and for an integration you stopped using. Access outlives the reason it was granted.

A test finds what a checklist cannot: the logic your product invented, the flow nobody drew, the door you did not know was there. Buy one after the basics, not instead of them. That order saves money.

If a customer's questionnaire asks when you were last tested, the honest answer changes the timing. Get the test, then fix the basics with the findings in hand. That order works too.

None of this is a certification. It does not make the risk go away. It writes the risk down.

The examples in these notes are illustrative. Nothing here describes a client engagement.