The Audit · Debug Season · Pulse Beat
Lakshmi suggested the audit. "A real one," she said. "Outside people. Security researchers, with permission to try to break it. We publish what they find." "Publish?" "Everything. Even the bad…
Lakshmi suggested the audit.
"A real one," she said. "Outside people. Security researchers, with permission to try to break it. We publish what they find."
"Publish?"
"Everything. Even the bad things. Especially those." She raised an eyebrow. "You wrote four pages about a bug that could have ended the company and the company got stronger. Why would you stop?"
It cost most of a month's money and he lay awake for several nights. The auditors, a firm of four, took three weeks and found eleven problems, none catastrophic: a weak password rule, a missing rate limit, a log that kept an IP address longer than it should. They also found, with a clinical note that made him wince, that the deletion path from the first bug had a gap that would have let a deleted page return in a backup.
He read the report standing up. Then he sat down and read it again, slowly, the way he read the first bug. Lakshmi was watching his face. "Well?" she said.
"Fix them all," said Vikram. "Then publish."