Security is part of the product, not a page about the product.
These are the principles I hold my own products to. Where a specific product has boundaries worth stating, they are stated on that product's page too.
- 01
Secure by default
The default configuration is the safe one. Security is not something you switch on afterwards or read a guide to enable.
- 02
Least privilege
A product asks for the narrowest access that lets it do its job, and no more, for as short a time as possible.
- 03
Explicit boundaries
Where data goes, and where it does not, is stated plainly on the product page rather than implied.
- 04
Encrypted connections
Connections between components are encrypted, including where a product is operating within a local network.
- 05
Careful logging
Sensitive data is excluded from logs that do not need it. Diagnostics should be useful without becoming a second copy of your data.
- 06
Local-first should not mean less secure
A product that runs locally should not require weakening security settings, disabling protections or opening things up to work.
If you believe you have found a security issue in a Paddy Systems product, please get in touch and I will respond.