Security is work
Most teams do not ignore security because they dislike it. They ignore it because it has no owner, no acceptance criteria, and no visible place in the delivery system.
Design smell: a security concern that appears only at release time is usually a planning failure, not a testing failure.
Turn risks into backlog items
A useful security backlog maps concrete risks to engineering work: authorization tests, secret rotation, dependency scanning, rate limits, audit events, and safer defaults.
risk: cross-tenant access
control: tenant-scoped queries and authorization tests
signal: audit event for privileged reads
review: pull request checklist and threat model noteA security definition of done
The team needs a short standard that fits normal delivery. It should name the checks that matter and the signals that make the system reviewable after deployment.
- Authorization path covered by tests
- New secrets documented and rotatable
- Audit event emitted for privileged action
- Operational dashboard updated for risky flow