Security Reviews That Developers Don't Dread

Every codebase has one area everyone is a little afraid to touch. On our team, it was everything related to least privilege.

When we finally measured, the numbers were worse than anyone guessed. Around 45% of the time spent on a typical change went into working around least privilege rather than building anything.

Where we started

The first symptom was subtle. Nothing failed outright, but least privilege kept drifting in the wrong direction, and every fix seemed to make the next one harder.

We had good intentions. We even had a document describing how least privilege should work. The trouble was that the document and the code had quietly gone their separate ways.

What we changed

We started by writing down the one rule we actually cared about, then deleted every bit of code that didn't serve it. It's not glamorous, but it works.

The core of it looks like this:

cosign sign --yes ghcr.io/acme/api@sha256:3f1c...
cosign verify \
  --certificate-identity-regexp 'https://github.com/acme/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/acme/api@sha256:3f1c...

This alone let us delete a surprising amount of code elsewhere in the project.

A few things that helped along the way:

• Agree on what "done" means before the first pull request.
• Delete dead code aggressively; it's the cheapest refactor there is.
• Keep the old path around until the new one has survived a real incident.

Where this breaks down

The biggest cost was social, not technical. Changing how people think about least privilege takes much longer than changing the code.

There are cases where this falls apart. If your team is very small or your traffic is very spiky, the extra moving parts may not pay for themselves.

What's next

I don't think there's a universal answer here, but I hope this gives you a few ideas to try on your own project. If you do, I'd love to hear how it goes.