Hossam EL-Kashef

The Horizon

12 security habits that would have helped this week

23 October 2026 · Hossam EL-Kashef

Animated cheat sheet: 12 security habits, each with a small diagram and the tools it's used in

This week was busy. First secrets became the target at Railway. Then PHP needed a patch, then GitLab needed one too.

None of it needed anything clever to handle well. It needed habits that were already in place before the news came out. Here are the 12 I keep coming back to. Each one has tools most teams already pay for or can use for free.

The 12 habits

Same order as the animation above.

  1. One secret store. Every key lives in one vault, not copied into ten .env files and wiki pages. When something leaks, you know where to look. Used in: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault.
  2. Short-lived tokens. CI should get a token per run that expires on its own, not a long-lived key saved in settings. Used in: OpenID Connect (OIDC) in GitHub Actions, with AWS, Azure or GCP.
  3. Spend limits and alerts. A stolen cloud or API key often shows up first as a bill. Budget alerts and provider usage caps turn that into a page, not a surprise at the end of the month. Used in: AWS Budgets, provider usage limits.
  4. Rotate in under an hour. Have a written runbook for rotating every important key, and test it before you need it. Used in: AWS Secrets Manager rotation, Vault dynamic secrets.
  5. Know what you run. You can’t patch PHP or GitLab fast if nobody knows which servers run which version. Used in: SBOMs, OWASP Dependency-Track.
  6. A patch deadline for criticals. Agree it once: critical fixes get a deadline in hours or days, not “next sprint”. Used in: Dependabot, Renovate for code dependencies, plus a ticket SLA for servers.
  7. Secret scanning on every push. Catch keys before they reach the repo, not after. Used in: GitHub secret scanning and push protection, Gitleaks.
  8. Least privilege. Each token does one job. A deploy key that can also delete the database is two problems waiting. Used in: IAM roles, fine-grained / scoped tokens.
  9. MFA everywhere, phishing-resistant for admins. Passwords plus SMS codes still get phished. Passkeys and hardware keys are much harder to steal. Used in: passkeys, FIDO2 security keys.
  10. A WAF in front of old apps. Some apps can’t be patched today. A web application firewall rule buys time, but it’s not the fix. Used in: Cloudflare WAF, AWS WAF.
  11. Alert on odd processes. A web worker that suddenly starts a shell is a red flag, whatever the CVE number. Used in: Falco, EDR tools.
  12. Logs someone actually reads. Alerts should reach a person who owns them, not a folder nobody opens. Used in: AWS CloudTrail, a SIEM.

Where I’d start

If you only pick two this month: short-lived tokens in CI, and a patch deadline for criticals. Both are cheap, and both would have made this week shorter for a lot of teams.

Which one is missing in your team?