Zero-downtime deploys on a budget: Laravel + AWS in prac...
Apr 24, 2026
97
Security is not a sprint at the end — it is a handful of defaults baked into every project on day one.
The non-negotiables
- Dependency review in CI, with weekly SCA reports reaching the engineering lead.
- Explicit RBAC from the first migration. No "admin flag on the user model" shortcuts.
- Signed URLs for every file the user should not enumerate.
- Rate limiting on every write endpoint — measured, not guessed.
- Audit log at the aggregate root, append-only, tamper-evident.
Secrets
Secrets live in a real secrets manager (AWS SSM, HashiCorp Vault). Not in .env files committed to a private repo, not in CI variables that nobody reviews.
The review that catches the most
Threat-model every user-supplied string. What if it is 10MB? What if it is binary? What if it is signed by a different key?
Keep reading
Related Posts
Popular Posts
