Category: Shipping Secure

Yesterday I posed the question of how much information my app really needs to ask for. Here’s the rule I’m building around: Collect only what you can explain. What that means in practice: None of this is fancy. It’s a habit of asking “why do I need this?” before you add the field. Here’s the…

Yesterday I wrote about what a one-word status in California’s DROP tool does and doesn’t tell you. The same trap shows up when you build an app: a simple yes or no can hide what it left out. I’m building a product that handles other people’s business records. I’m not a security expert. This week’s…

Yesterday I posed the question of how I know what my app is actually doing with people’s information. Here’s the rule I’m building around: Check it on a schedule, and write down what you didn’t check. What that looks like for me: None of this is fancy. It’s a habit of looking, writing down what…

On Tuesday I wrote about the court order against Meta in New Mexico, which followed a jury finding that the company misled users about how their information was handled. Meta says it will appeal. The gap between what people are told and what actually happens is the gap I’m asking about this week. Here is…

Yesterday’s question was what the AI in my build is allowed to do on its own. Here’s the answer I settled on, in one line: AI assists. Verified rules enforce. Authorized people decide. What that means in practice: Two more things I added: If you’re building something with AI in it, you can borrow this…

On Tuesday I wrote about lawsuits over data sitting in systems where it wasn’t clear who could look at it, who could share it, and who was checking. Those cases are allegations and none has been decided, but the questions they raise are worth carrying into your own build. Tuesday’s post I’m building a product…