Moving Fast and Securing Things
summary
Slack describes a Secure Development Lifecycle that scales a three-person product security team to thousands of engineers by shipping a self-service assessment tool (plugin-based, JSON checklists), a checklist generator, and a chat-based process inside Slack. Claims: ~100 deploys/day, ~150 SDL submissions so far, trend of bugs reported via bug bounty is flat-to-decreasing. Tooling links into JIRA, surfaces risk ratings, tracks completion, and is planned for open source; results report higher checklist adoption and fewer introduced bugs.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:58Slack
- 6:15Transparency
- 10:13SelfService STL
- 12:36Checklists
- 16:03Process
- 19:17Security Product Channel
- 21:54Feature Channel
- 23:08Checklist
- 24:19Checklist Feedback
- 26:56Security Background
- 27:33Positive Feedback
- 28:28User Feedback
- 30:56Real Bugs
- 31:16High Grade
- 32:14SPL Graph
- 33:37Open Source Tools
- 35:29QA Process
related talks
26mBuilding Secure Cultures
28mSlack App Security: Securing Your Workspaces From a Bot Uprising
19mBalancing fast-paced innovation and technical debt
43mDeveloper Driven Security In High-Growth Environments
50mCase Study: 10 Steps to Agile Development without Compromising Enterprise Security
45mHow Leading Companies Are Scaling Their Security
28mHow we do developer productivity at Slack
43mSlack’s Vulnerability Aggregator: manage vulnerabilities at scale