[toomuchtodo]

n=1, head of a security at a fintech. We perform automated scans of external facing sensitive routes and pages after deploys, checking for PII, PAN, and SPI indicators, kicked off by Github Actions. We also use a WAF with two person config change reviews (change management), which assists in preventing unexpected routes or parts of web properties being made public unexpectedly due to continuous integration and deployment practices (balancing dev velocity with security/compliance concerns).

Not within the resources of all orgs of course, but there is a lot of low hanging fruit through code alone that improves outcomes. Effective web security, data security, and data privacy are not trivial.

[15457345234]

> fintech

You keep your business logic and account handling code on github?

Not an accusation, genuinely asking.

[jaredklewis]

Not the parent, but my previous employer was a fintech company and all the code was on private github repos.

[toomuchtodo]

Why would you not? Outsource anything not a core competency.

[15457345234]

Oh, good advice there.