Skip to content

Add "Secure by Design" principle #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jbro-tp wants to merge 9 commits into
base: main
Choose a base branch
from
Open

Add "Secure by Design" principle #10

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
5d717fc
Add "Secure by Design" principle
jbro-tp Jul 30, 2026
2d1018c
Narrow scope to protecting customer data
jbro-tp Jul 30, 2026
4b3479d
Reference our engineering standards for security
jbro-tp Jul 30, 2026
8440d86
Drop secure-defaults sentence
jbro-tp Jul 30, 2026
2300eec
Reword the threat-modelling sentence
jbro-tp Jul 30, 2026
af4280a
Use "a high standard" instead of "a high bar"
jbro-tp Jul 30, 2026
8b7e1ff
Drop the worked example
jbro-tp Jul 30, 2026
93ff9d4
Refer to our engineering standards generally
jbro-tp Jul 30, 2026
e45ffd9
Add secure defaults sentence
jbro-tp Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,3 +40,7 @@ Software Engineering is a team activity where we win and lose together: there is
### Prefer Small Changes

Many small changes are less than the sum of their parts but they're easier to reason about. A small change is easier to give feedback on, easier to roll-back, can build confidence and comfort through frequent releases, and is harder to get “wrong”. Many small changes allow for many small improvements. And bluntly, 10KLOC PRs don’t get good reviews!

### Secure by Design

We’re all responsible for the security of our systems, holding them to a high standard to protect the data our customers trust us with. Think about how someone could abuse a system, whether they’re outside the company or already inside it, and close those gaps before it ships. We prefer systems with secure defaults, leveraging existing solutions where possible. Our engineering standards describe what this looks like in practice, and following them is how we get there.