Practical, opinionated security habits for people who write and ship code.
"Hackers don't break in. They walk through the door you left open."
Developers and small engineering teams, especially those handling secrets, infrastructure, or money (crypto, fintech). Each chapter explains the threat, shows a real incident, and gives you steps you can do today.
Attackers rarely beat your production defenses head-on. They go after the developer, because a developer's laptop, accounts and tokens lead everywhere.
The handbook is organized around cutting each arrow: harden the endpoint (I), filter what comes in (II, VI), secure the pipeline (III), limit what a stolen identity can reach (IV), assume it will still happen (V), and fix the human and process gaps (VII).
If you only do a dozen things, do these.
- Put a passphrase or hardware key on every SSH key (1.1)
- Sign your commits (1.2)
- Use a password manager, unique passwords, and hardware-key or passkey MFA (1.3)
- Stop keeping secrets in
.envfiles. Inject them at runtime (1.5) - Vet every new dependency and commit your lockfiles (2.1)
- Never run secrets or
--privilegedin containers (2.2) - Don't open unexpected files from chat or email (2.4)
- Pin CI actions to SHAs and use OIDC instead of stored cloud keys (3.1)
- Remove standing production access. Use JIT (4.2)
- Run AI agents with approvals on, and verify every package they suggest (6)
- Never run a recruiter's "coding challenge" on your real machine (7.1)
- Know who to call and what to revoke when something goes wrong (5.2)
| Part | Topics |
|---|---|
| I. Developer Identity & Workstation | SSH keys and YubiKey · signed commits · passwords, MFA and passkeys · secrets sharing · .env files · firewalls · device monitoring |
| II. Supply Chain & Dependencies | Package attacks · Docker hardening · fake download sites · malicious PDFs and files |
| III. DevSecOps & Shift-Left | CI/CD security · secure coding · SAST, DAST, SCA and secret scanning |
| IV. Access & Infrastructure | VPN and MFA · just-in-time privileges · cloud security |
| V. Detect & Respond | Logging and alerting · incident response · runbooks (leaked secret, bad dependency, lost laptop, cloud compromise) |
| VI. AI-Assisted Development | Prompt injection · malicious MCP servers and rules files · hallucinated packages · secrets in prompts · agent permissions |
| VII. People & Process | Fake recruiters · social engineering · SIM-swap and account recovery · onboarding and offboarding |
Copyable checklists: onboarding · offboarding
Each chapter follows the same shape: threat → real incident → what to do. Every part shows a last reviewed date, and security advice ages quickly, so check it. Chapters are independent, so read in order or jump to what's relevant.
Corrections and additions are welcome. Open an issue or pull request. Please:
- Link to a primary source for every incident or statistic.
- Prefer concrete commands and config over general advice.
- Keep the tone direct and plain.
CC BY 4.0. Share and adapt with attribution.
Screenshots prefixed gh- in assets/ come from GitHub Docs, which is also licensed CC BY 4.0.