A supply-chain security scare took over a week that should have been about building the product. Suddenly we were looking closely at our dependencies, computers, credentials and access.
The part that bothered me was how ordinary the entry point could be. Updating a package is routine work. So is accepting a suggested installation while you're developing. A risk in that process can reach far beyond the feature you're working on.
We went back through the systems and tightened what we could. The work included updating our tooling and images, rotating secrets and thinking more carefully about how the team used work computers. It took time away from the roadmap.
I also had to think about access. Fewer people with sensitive access can reduce exposure, but concentrating everything in one person creates its own problem. That is a tradeoff a small team still has to work through.
The scare interrupted the work we'd planned and gave us a reason to go back through the setup carefully.
I was also clear at the time that taking these steps didn't make us impenetrable. We were improving the setup as far as we understood it, rather than claiming we'd removed every risk.
As a founder, it's tempting to see that work as something separate from making progress. But the product depends on the systems around it continuing to work.
That week brought those dependencies into focus. We had to give them attention before getting back to the things we were excited to ship.
