Security Guides

How do you write the AI section of a security tool requirements doc?

Write AI requirements as testable statements across inventory, MCP, agent permissions, data handling and evidence. A template with examples you can adapt.

Why should you write your scanner decision rule before the first scan?

Write the pass, fail and tie rules for a scanner comparison before any results exist. It stops hindsight and the loudest voice from picking the winner.

How do you write an upgrade runbook for a vulnerable dependency?

A dependency upgrade runbook covers confirming exposure, picking a version, testing, rollout and rollback. Use this template so any engineer can run it.

How do you write an SNS to SQS queue policy without a confused deputy gap?

Allow the SNS service to send to your SQS queue, then add an aws:SourceArn or aws:SourceAccount condition so only your topic can. Example and checks.

How do you write a security options memo with a recommendation?

A good options memo states the decision needed, two or three options with trade-offs, and one clear recommendation, in one page a leader can act on.

How do you write a security bug report a vendor can act on?

Report a vulnerability with a clear summary, affected version, minimal reproduction, impact, and your disclosure intentions. A checklist for researchers.

How do you word a security alert in chat so people act on it?

A chat security alert works when the first line says what to do and who it is for. Use this four part format, skip the fear words and cut the noise.

How do you write a postmortem that readers outside your team can use?

Add a background section and glossary, give numbers, explain recovery and share widely. How to write an incident review other teams can learn from.

How do you write a one-page security test plan for a release?

A one-page template for planning security testing before a release: scope, methods, owners, pass criteria and sign-off. Short enough that people use it.

What should a blocked extension message say to your employees?

Chrome and Firefox let you add custom text when an extension install is blocked. Here is how to word it so people ask you instead of working around it.

How do you write the first paragraph of a security advisory?

Open an advisory with a direct 40 to 60 word answer: who is affected, what to do, and by when. A formula, three examples and a checklist you can reuse.

Working from a short term rental or coworking space: network checklist

Checklist for developers working from a rental or coworking network: what to ask, what to check on the router, and when to use your own hotspot instead.