9 Cybersecurity Habits That All Builders Should Have

I recently addressed a few cybersecurity vulnerabilities in my project and my Mac because I entered a security rabbit hole described in the following article: How a 75-Cent Error Uncovered a KGB Espionage Operation.

Most of them are basic measures that we should all take from time to time, or habits that should be ingrained in our routine as builders.

They can be missed or forgotten, so I’m sharing them below as a healthy reminder:

#1 Run “npm audit” in your projects from time to time

This is an easy way to spot vulnerable dependencies and patch many of them on the spot via “npm audit fix”.

#2 (Related to #1) Avoid “npm audit fix –force” unless you have good reasons to do so.

It can lead to unexpected results and break your app, creating more issues than it resolves.

#3 Activate Dependabot on GitHub

Dependabot is a tool that proactively informs you about vulnerabilities found in your dependencies, and it’s so easy to activate that it doesn’t make sense not to do it.

#4 Activate Two-Factor Authentication for all of your services

This is easy to miss if you have many accounts. For example, I’m well aware of its importance, but I found two accounts where it wasn’t activated.

Worth checking if you haven’t done so already.

#5 Remove full-disk access for apps that do not need it

This is the kind of thing that we activate because an app needs it for a specific task and then we never turn it off.

It can be activated if strictly necessary, but it should be revoked once the task is completed. Full-disk access is too much for apps that ultimately don’t need it on a day-to-day basis.

#6 (Related to #5) Review folder access, accessibility and app management permissions of your installed applications

In my case, Grok Bot had access to many folders as well as App Management, meaning that it could remove other apps without my consent.

I don’t even use Grok Bot anymore, so this was totally unnecessary!

Check your system settings from time to time to ensure that no app has more permissions than it needs, especially if you don’t use it often.

#7 Back up recovery keys in password managers like Apple Passwords

These are, for example, the recovery keys you get from a service when Two-Factor Authentication is activated, or encryption keys for tools like the Automic Vault to secure your secrets.

Save them because you may need them in the future, and also make sure you do it in a safe way.

#8 Verify package names before installing them

Here’s a story of something that happened to me: I ran a command before a dependency was installed and it returned a 404 because it was not found. But what happened in the background? npm tried to install it and didn’t find it, so it errored.

However, what would have happened if I instead had a typo and there was a malicious dependency with the incorrect name (e.g., I installed “example-dep” instead of “exampledep”)?

npm would have installed it, and I probably wouldn’t have noticed. This happened to some developers in 2017 when trying to install “cross-env” and instead installed “crossenv,” without the dash. Result: they ended up with a fake dependency that sent their environment variables (where secrets like API keys usually live) to the attacker.

Solution: double-check the name of dependencies in their official docs or GitHub repo before installing them. Copy them directly from there for extra security.

#9 If you suspect that a secret has been leaked in any way (e.g., a database URL pasted directly in the terminal to run a command) rotate it immediately

This takes a few minutes and is the only way to make sure a leaked secret is useless to whoever got it.

Those are the 9 things I worked on when I found myself in the security rabbit hole mentioned earlier. If you don’t quite understand any of them, feel free to pass the list to your AI assistant. It will be more than capable to clarify and guide you through it.

(Just make sure not to give it your secrets!)

Security is becoming more and more important with the advent of AI. Dedicating a few minutes or hours to it from time to time can be extremely valuable for our safety and peace of mind.

Try the 9 recommendations above and, if you find yourself being curious about anything else, go explore it.

You will not regret hardening your security in the times we live in.