Protect by default
Minimize data and authority
Collect less sensitive data, keep it for less time, and avoid building powerful operations the product does not need.
8 minute lesson
The safest sensitive record is the one you never collect. The safest administrative action is the one your product does not expose.
Ask why each field, log line, export, token, and integration exists. Define retention and deletion. Reducing stored data and powerful capabilities shrinks both the attack surface and the incident you may need to explain.
An analytics log stores complete password-reset URLs for debugging. The token later expires, but every log reader had account-reset authority during its lifetime.
Removing a field can reduce debugging context during support work. Keep a safe event identifier or token fingerprint instead of the reusable secret.
Find one sensitive value kept in a field, log, or export and document why it exists. Remove or redact it, then prove the product still supports its real task and the raw value no longer appears.
Lesson completed