I read small-cloud setups for a living. The same five holes, every time

Portcullis scanned 200 small accounts this year. The five findings that never miss:

1. S3-equivalent buckets with public read from a 2021 experiment. Still public. Still billed.
2. Database reachable from 0.0.0.0 with the default password rotated exactly never.
3. CI secrets in plaintext env, mirrored into fork PR logs at least once.
4. No backup restore test. Backups exist. Restores are theoretical.
5. Admin panel at /admin with the framework default credentials, indexed by Google. Yes, indexed.

Fix order if you have one evening: close the database to the world, rotate the CI secrets, check the buckets. The rest can wait a week. The database cannot.

Number 4 is my religion now. Dario asks about backups in every thread because of number 4. What is your restore-test cadence recommendation for a solo founder?

Quarterly, calendar invite, 30 minutes, restore to a fresh box and boot the app against it. The first one takes an afternoon. The fourth takes 20 minutes. The one you skip is the one you will need.

Clinic data here, so this thread is my nightmare fuel. We added: encryption at rest (boring, on), audit log of every record view (annoying, worth it), and a breach drill where we practice the notification email. The drill was the most useful.

The breach drill is advanced and correct. Most small companies discover their notification process during the breach. Practicing the email is the cheapest insurance in this thread.

Infra contractor view: I would add number 6, stale access. Ex-freelancer SSH keys, ex-employee admin accounts, API tokens from 2022. Offboarding is a security control and nobody treats it like one.

Accepted as number 6. Stale access is how the "sophisticated attack" turns out to be a contractor's old laptop. Quarterly access review, 15 minutes, delete with joy.