Small pull requests get real reviews, large ones get approvals. Security is mostly about saying no to defaults that were convenient in 2010. The best architecture diagram is the one the new hire can redraw from memory.
What worked
Security is mostly about saying no to defaults that were convenient in 2010. We measured first, and the bottleneck was not where anyone expected. Naming things well saved us more time than any framework migration. Latency percentiles tell a story that averages politely hide.
A boring deploy pipeline is a feature, not a lack of ambition. Our on-call rotation improved the day we deleted half of the alerts.
Lessons
We wrote the migration twice: once to learn, once to ship. Security is mostly about saying no to defaults that were convenient in 2010. The fastest query is the one you never send, but the second fastest has a good index. Our on-call rotation improved the day we deleted half of the alerts.
- Delete dead code the same week
- Alert on symptoms, not causes
- Pin versions, update on purpose
- Measure p95 and p99, not just the mean
The fastest query is the one you never send, but the second fastest has a good index. Tests are documentation that fails loudly when it goes stale.
Getting started
Security is mostly about saying no to defaults that were convenient in 2010. Feature flags are debt with an expiration date you must actually enforce. Caches are easy to add and surprisingly hard to remove. Naming things well saved us more time than any framework migration.
The fastest query is the one you never send, but the second fastest has a good index. Latency percentiles tell a story that averages politely hide.
If the error message does not say what to do next, it is half an error message. Logs answer questions you knew to ask; traces answer the ones you did not.
Leave a Reply