Least privilege, and the export that leaked

Exports once landed in a team-visible drive, so the whole engineering team could read financial data while the person who requested it got a permission error.

1. VideoWhat happened, and the three defects behind itA shared destination, a swallowed share error, and a service account with custody of data it had no business holding.Preview6 min
2. VideoWhy the requester got an error and everyone else got the file6 min
3. ReadingReading an incident without blaming the person who shipped it5 min
4. VideoA shared destination is a design decision, not an accident6 min
5. VideoWhat financial data sitting in a team-visible drive actually means6 min
6. VideoThe gap between “it works” and “it is safe”, in one incident5 min

A storage location whose only member is the service account, a share with exactly one person, and an audit log on every delivery.

1. VideoA location with exactly one member6 min
2. VideoSharing with one person, and verifying the share landed6 min
3. VideoResolving that one person from the same token that ran the query6 min
4. VideoWhy the service account is still in custody, and what that still risks6 min
5. LabLab: build generation one and test the failure path15 min
6. VideoEvery delivery audit-logged, and why that matters even when the design is right5 min

A required email domain, and a delete-on-failure rule so a swallowed error never leaves an orphaned file with a link that 404s.

1. VideoRequiring a corporate email domain before a share goes out6 min
2. VideoDelete the file if the share failsA swallowed share error returns a link that 404s while the data sits orphaned. Delete, then report the failure.6 min
3. VideoWhy a swallowed share error is worse than a loud failure6 min
4. ReadingWhat the audit log needs to answer, six months later5 min
5. LabLab: simulate a failed share and confirm the file is gone14 min

Create the file in the user’s own storage with the user’s own token. The service account never holds the data at all.

1. VideoCreating the file under the caller’s token6 min
2. VideoNo parent folder, so it lands in the user’s own space by default6 min
3. VideoOwned by them, shared with no one, from the moment it exists6 min
4. ReadingWhat the second generation removed from the threat model5 min
5. LabLab: build generation two, zero service-account custody15 min

Generation one shipped first because it was safer to ship fast. Generation two shipped second because removing custody entirely takes longer to get right.

1. VideoWhat generation one still trusted, that generation two does not6 min
2. VideoWhy generation one shipped first, and generation two second6 min
3. VideoThe cost of each: engineering effort against risk removed6 min
4. VideoWhen generation one is still the right answer6 min
5. ReadingA one-page comparison for a client who only has five minutes5 min
6. VideoThe per-user token from course 3.8 is what makes generation two possible5 min

The shape of this defect recurs anywhere your org exports data. This module is the checklist for finding it before an incident does.

1. VideoThe shape of the defect, generalised beyond this one incident6 min
2. LabAuditing an existing pipeline for the same shape15 min
3. VideoFive questions to ask about anywhere your org exports data6 min
4. ReadingWriting the audit finding so it gets fixed, not filed5 min
5. LabLab: write an audit checklist for custody defects12 min
6. QuizCheck: least privilege and custody9 min