Stratorys Onboarding

Appearance

Security policy ​

This page covers operational security rules. For design-level security principles (least privilege, secure defaults, proven libraries), see the engineering guide.

Passwords and authentication ​

  • Minimum 32 characters for all passwords
  • Never reuse passwords across services
  • Use 1Password to generate and store every credential
  • Enable 2FA on every account that supports it (prefer app-based over SMS)
  • Use team vaults in 1Password for shared secrets

SSH keys ​

  • Only ed25519 keys - never RSA
  • Protect private keys with a strong passphrase
  • Never share private keys
  • Add the public key to GitHub for both authentication and commit signing
  • Configure Git to sign all commits with your SSH key

See Soatok's guide for rationale on modern signing practices.

Code security ​

  • Never commit secrets (API keys, passwords, tokens)
  • Use .env files for local config and add them to .gitignore
  • All changes require review before merge - no direct pushes to protected branches
  • Report suspected vulnerabilities immediately

Device security ​

  • Enable full-disk encryption (FileVault on macOS, LUKS on Linux)
  • Lock your screen whenever you step away (Cmd + Ctrl + Q on macOS, Super + L on Linux)
  • Keep OS and apps updated
  • Avoid public Wi-Fi for sensitive work - use a hotspot if needed
  • Report lost or stolen devices immediately

Network ​

  • Disable unused services and remove unneeded software
  • Use a trusted hotspot over public Wi-Fi
  • Ask your team lead about VPN if you work from untrusted networks

Incident reporting ​

Report immediately if you see:

  • Suspicious emails or phishing attempts
  • Compromised or potentially compromised credentials
  • Unusual system behavior (unexpected prompts, new processes, alerts)
  • Any security concern, no matter how small

Contact: security@stratorys.com or #dev on Slack