The core security question
"Why security is about judgment, not compliance."
Hammad MajidWhy this exists
Rules only cover the situations we anticipated. Good judgment covers the rest. This handbook is not a checklist. It is a guide to help you make the right call when no rule exists.
Operational Flow
Own the access: You know what systems you can reach. You are responsible for whether you should have access.
Secrets are not shortcuts: Hardcoding a token to save time is never fast. It is high-interest technical debt.
Respond fast: When a system breaks, communication speed matters more than a complete diagnosis.
Verify dependencies: You are betting on every library you import. Make sure it is maintained and safe.
Respect data: You do not own client data. Act like a guest.
Build habits early: Practice good security hygiene when the stakes are low.
What good looks like
- The team acts securely by default, without needing to check the rulebook.
- Incident responses are calm because we have written runbooks and clear roles.
- A developer notices a potential credential leak in a PR and calls it out immediately.
- An engineer explains how we protect database records to a client in three clear sentences.
What NOT to do
- Don't use process as an excuse. 'I followed the handbook' is not a defense for a bad decision.
- Don't assume security is someone else's responsibility. It belongs to everyone.
- Don't treat the absence of a rule as permission. If you wouldn't defend the choice to the client, don't do it.
Security at a small agency is a cultural choice, not a technical one. The tools (Doppler, 1Password, Dependabot, encrypted storage) are cheap and easy to set up. The real work is building a team that makes the safe choice without being prompted. We want a team that treats other people’s data with the same care they expect for their own.
The test isn’t whether you can recite this handbook. It is whether you make the right call six months from now when there is no rulebook open and the shortcut is right in front of you. Build these habits now. You will need them when the stakes are high.