Nobody claps for the lock on the door

Product work has a nice feedback loop. You ship a thing, someone uses it, they tell you it is good or they tell you it is broken. Security work has no loop at all. You ship it, and then nothing happens, forever, and that is the success case.

The only time anyone learns about your security is the day it did not work. So here is the inventory while it is still boring.

Every admin has 2FA. Not optionally.

Every account that can touch the admin panel carries a TOTP code. Not "we encourage it", not a nag banner someone dismisses for four months. You cannot hold admin access on Book A Sloth without it.

This is an easy decision to make when you have three admins and an impossible one when you have three hundred, which is precisely why you make it at three. Every optional security control is a control that is off for the people most likely to be phished, because those are the people in the biggest hurry.

There are recovery codes, because mandatory 2FA without a recovery path is just a way to lock yourself out of your own company at 2am. And there is a break-glass route through the database, because the recovery codes live in a password manager that is also a single point of failure.

The bans are automatic

Repeatedly probing our login endpoints gets your IP blocked without a human involved. There is a queue an admin can review, but the blocking does not wait for one, because the attack does not wait for one either.

The interesting decision is what happens if the blocklist itself breaks. It fails open — if the check errors, you get in. Failing closed would mean one bad query takes the entire platform offline and hands anyone who finds that bug the ability to lock out every host in the country. Fail-open here means a bad afternoon; fail-closed would mean a bad quarter.

We wrote that trade-off down at the time rather than discovering it during the bad afternoon.

Payments do not trust the browser

This one is old enough that we have written about it separately, but it belongs on the list. No price is ever taken from the client. Every payment signature is verified server-side. The browser is a display layer, and a display layer is not a witness.

The point

None of this appears on a pricing page. No host has ever chosen us because our admins have TOTP. It is pure cost, paid early, in the hope that the story never gets written.

The only reason to publish an inventory like this is so that you can check it. A platform that tells you what it does is a platform you can hold to it later.