I argue security starts with being paranoid. Not that I don&#x27;t trust anyone I work with, including myself, but I can leak emails or my computer can get hacked. Shit happens. So I would start with the worst case and ask myself how to defend against any leaks.<p>External service SLA can be joke. It&#x27;s always aftermath thought. Damage control is always on the customer side because customer has to rotate &#x2F; invalidate leaked credentials, so first step for me is to have a process to invalidate credentials as often as possible.