Security practices
Security is part of the engineering work
Every project has different data, users, and risk. We establish the right controls in the project scope and keep the implementation understandable rather than relying on broad certification claims.
Access is scoped to the work
We request the minimum repository, cloud, and vendor access required for an engagement and remove access when it is no longer needed.
Credentials stay out of source
Secrets belong in managed secret stores or approved deployment systems, never in source files, screenshots, or project documentation.
Changes move through review
Protected branches, pull requests, automated checks, and traceable deployments are the default for production code.
Data handling is explicit
We identify sensitive data early, limit collection, encrypt transport, and design storage and retention around the project requirements.
Dependencies are deliberate
Libraries and services are selected for a clear purpose, kept current, and removed when their operational value no longer justifies them.
Problems are documented and corrected
Security findings are triaged by impact, fixed through the normal review path, and communicated to affected project owners.
Report a security concern
Send enough detail for us to reproduce the issue without including credentials or sensitive customer data.
security@fencepencil.comFor project questions, use the project inquiry.