OPSEC Checklist — Think Like an Adversary

■ Ask on Monday

Five questions for your next morning meeting. Tick each one once your team has actually answered it.

Who can merge to main?
Who can deploy to production?
Who has the payment dashboard?
Who can delete database backups?
Who has root on your servers?

If the answer to most of these is “everyone” or “I'm not sure,” that's exactly where to start — because if it's “everyone,” your blast radius is your entire company.

■ Solo Founder

.env in .gitignore and not web-accessible
Secrets rotated quarterly
2FA on GitHub, hosting, payment providers
CI/CD tokens scoped to minimum permissions
Written list of services with production access
composer audit in your pipeline

■ Small Team (2–10)

Everything from Solo Founder, plus:

Access segmented by role
Onboarding/offboarding access checklists
Quarterly access reviews
Team trained on social engineering basics
Incident response plan (even one page)
Secrets in a vault, not in Slack

■ Enterprise

Everything from Small Team, plus:

Formal trust levels for systems and information
Tabletop exercises at least annually
Vendor security assessments before integration
Contractor access scoped and time-limited
Incident response plan tested, not just documented
Security review in deployment pipeline

■ Red Flags

🚩"Everyone uses the same deploy key"
🚩"We'll set up access controls later"
🚩"The contractor still has access but it's fine"
🚩"Our incident plan is 'call the CTO'"
🚩"We've never tested a backup recovery"
🚩"Only one person knows the server config"

OPSEC Checklist for Laravel Developers

■ Ask on Monday

■ Solo Founder

■ Small Team (2–10)

■ Enterprise

■ Red Flags