Basic security practices

1Devices

Keeping laptops and phones secure is vitally important. We're a software company and many of us have access to secure systems (both our own and our customers).

The following guidelines apply to how we physically secure our laptops and mobile devices that may contain customer or user data.

1.1General

• Make a note of serial numbers, model information
• Two Factor Authentication and strong passwords
• Keep your operating system and applications up to date
• Lock your device when you are away from it.
• Don't leave your devices unattended in an unsecured area.
• Install a device tracking and remote data wipe tool such as Prey.

Note (October 2026): parts of this checklist predate current devices. Apple silicon Macs have no firmware password, so rely on FileVault, a strong login password and Find My. Prefer an authenticator app, a hardware key or a passkey over SMS codes for two-factor authentication. Check the vendor links below, since several point to old support pages.

1.2Desktop

• Encrypt your hard drive
• Mac users must add a firmware password
• Non Mac users must add a BIOS password
• Disable automatic login for OSX
• Auto logout after five minutes inactivity
• Require password after screensaver or sleep
• Only work from company laptops or follow BYOD policy
• Install iCloud/Find My Mac

1.3Mobile

We all use personal mobile devices, so your options are either not to add any company accounts to your phone (this includes Slack, Gmail etc), or to follow the checklist below.

• Ideally disable finger print login (or at least have TouchID on).
• Create a 6 digit passcode (or better)
• Turn on auto lock after 5 mins

1.4Using passwords

• Use a unique password for every account you create.
• Use a tool like pwgen or 1password to generate random passwords.
• Use a tool like GnuPG to encrypt passwords if you need to share them with somebody.

1.5Encryption

• Use a PGP signature in an email if you want somebody to trust that you wrote it.
• Use PGP to check email signatures if you want to know who wrote it.
• Use PGP to encrypt emails if you want to be sure nobody but the recipient is reading it.
• Use ultimate trust for your own keys.
• Use full trust for keys you have verified in person or via a secure video chat.
• Don't share your private key with anyone, including services like Keybase.
• Keep at least one backup of your private key and revocation certificate in a secure location, such as a thumb drive.

2Handling vulnerabilities

• Depending on what you are making, limit access to your user databases.
• In case of a hack or data breach, check previous logs for data access, ask people to change passwords. You might require an audit by external agencies depending on where you are incorporated.

2.1If a device or account is compromised

A generic first-hour sequence. Adjust it to the system involved.

1. Contain: sign the device or account out everywhere, revoke sessions and API tokens, and disconnect the device from the network if it is lost or infected.
2. Rotate: change passwords and keys that the device or account could reach, starting with the ones that grant the most access.
3. Assess: check access logs for what was read or changed and when. Write down what you find as you go.
4. Tell: report it internally straight away to your lead or the ops team. If customer data may be involved, escalate at once, because notification obligations can carry deadlines.
5. Follow up: record what happened and what would have prevented it.

Report a lost laptop or phone immediately, even if you think it was only misplaced. A fast report costs little, and a slow one lets an attacker keep access.

3Security report

When someone finds a possible security issue in our software, we encourage them to report it to our security@d.foundation email address.

When an email comes in through this channel, reply quickly with confirmation (and CC security@d.foundation so others know that it has been handled) and the information for our PGP key, which is located at https://d.foundation/security.