Build stage · Module 10 of 15
Outcome for this lesson
Reduce exposure through secret handling, least privilege, data minimization, backups, updates, and recovery.
Bring forward: Bring the working slice, its known limits, and accessibility record.
Produce: A security and privacy boundary sheet with data inventory, permissions, secrets, retention, backup, and update owners.
0 of 15 core modules complete
Progress is saved on this browser. Create a free membership to sync across devices.
Recommended prerequisite: complete Module 9, “Build Accessibility into the Working Slice,” and bring its artifact. You may still use this page as a reference.
Build stage
Build the next result
A usable tool can still expose people or become impossible to recover. Apply the minimum necessary data, access, secrets, retention, backup, update, and incident boundaries before broader testing or release.
Your result for this module
A security and privacy boundary sheet with data inventory, permissions, secrets, retention, backup, and update owners.
Continuous case study
Worked example: Minimizing tracker data
The tracker removes message content and stores only a display name, inquiry date, status, and next action. API keys stay server-side. The owner reviews plugin access monthly, deletes inactive records after the stated period, and tests restoring a backup.
Do the work
Inventory data and purpose
For each field, record why it is needed, who can access it, where it flows, and when it is deleted.
Protect secrets and permissions
Keep secrets out of prompts, public code, browsers, screenshots, and support messages. Grant only the access required.
Plan recovery and updates
Assign backup, restore-test, dependency, access-review, and security-notice responsibilities.
Write the incident first response
Name who disables access, rotates secrets, preserves evidence, communicates, and obtains qualified help.
Copy-and-complete template
Create your module artifact
Data field, purpose, location, access, deletion: Secrets and protected location: Accounts and minimum permissions: Backup and last restore test: Update and access-review owner: Incident contact and first actions:
Keep sensitive information, passwords, API keys, payment data, and private customer details out of course notes and AI prompts.
Quality gate
Check the result before the quiz
- Unnecessary data is removed.
- Exposed credentials would be rotated, not hidden.
- Backups have been restored in a test.
- Operational owners and review dates are recorded.
How this moves the project forward
Module 11 turns every requirement and boundary into a complete test and regression record.
Evidence checkpoint and lesson summary
Confirm the artifact, then answer the key questions
The questions cover a core idea, a realistic decision, and evidence from the lesson. Incorrect answers identify concepts to review; they are not a complete measure of your experience or ability.
Confirm the artifact and answer all three questions correctly to unlock the recommended next step.
Continue to Module 11: Test, Debug, and Prove the Important Journeys