Handbook

Security

Security

We handle client code and client data. Security is not something we get to later. It is something we do now.

Accounts

Two-Factor Authentication

Enable 2FA on everything. Not optional.

GitHub

  1. Go to github.com/settings/security.
  2. Enable Authenticator App (not SMS, SMS is not secure).
  3. Save your recovery codes somewhere safe. Not on GitHub.

Email

Enable 2-Step Verification on your Google account: google.com/landing/2step

Device

Disk Encryption

If you are on a Mac, enable FileVault. If your laptop gets stolen, the thief should not be able to read client source code.

Instructions: support.apple.com/en-us/HT204837

Keep Your Recovery Key

If you lose both your password and recovery key, you lose access to everything on that machine. Store the recovery key somewhere separate from the laptop.