← Build log

The Solo Builder Security Playbook: How to Stay Safe While Moving Fast

Solo builders live in this weird paradox: we’re nimble, experimental, fast-moving—and simultaneously handling security, privacy, legal, and compliance for our entire company of one. The big companies have departments for this. We have… ourselves, a few bookmarks, and hopefully a healthy sense of paranoia.

This playbook is my living system for how I keep my projects secure while still shipping fast. It builds directly on the AI privacy post, but zooms out to cover the full security landscape for solo builders.

TLDR: What You’ll Get

Specific tools and systems to protect:

  • Your domains and DNS
  • Your customer data
  • Your AI tool usage
  • Your codebase and deployment pipeline
  • Your financial accounts
  • Your production systems

Bottom Line: You won’t be a sitting duck, but you also won’t be paralyzed by enterprise-level security overkill.

Core Principle: Attack Surface Awareness

Every system you add to your solo builder stack expands your attack surface. You can’t eliminate risk, but you can actively minimize your surface area and focus your defenses where it matters most.

I break this into 5 domains:

1. Domain & DNS Security

Why It Matters:

  • If someone hijacks your domain, they own your email, your website, your customer trust.

My Playbook:

  • Use reputable registrars (not random discount resellers).
  • Enable two-factor authentication (2FA) on your registrar account.
  • Use domain locking features to prevent unauthorized transfers.
  • Manage DNS with providers that support DNSSEC.
  • Avoid exposing unnecessary subdomains; keep DNS records lean.

Tools:

  • Cloudflare DNS (free tier is excellent)
  • Namecheap (with 2FA)

2. Customer Data Hygiene

Why It Matters:

  • Data breaches can destroy trust instantly.

My Playbook:

  • Store only what you absolutely need.
  • Use strong encryption for data at rest and in transit.
  • Never paste customer data into AI tools or public forums.
  • Use anonymized datasets for debugging or demos.
  • If handling sensitive data (health, financial, PII): consult legal frameworks (GDPR, HIPAA, etc.)

Tools:

  • Vaultwarden (self-hosted password manager)
  • Proton Mail (secure email for PII)
  • S3 with server-side encryption (for file storage)

3. AI Tool Usage Boundaries

(Expanded from my AI Privacy Cheat Sheet)

My Playbook:

  • Follow the “Trusted Assistant Rule”: if you wouldn’t email it to a contractor, don’t feed it to AI.
  • Never paste API keys, credentials, or full customer datasets.
  • Use enterprise AI plans when possible for stronger data isolation.
  • Regularly review AI vendor privacy policies.

Tools:

  • OpenAI (ChatGPT, but avoid sharing sensitive data)
  • Claude (more privacy-forward policies on some tiers)
  • Ollama (local AI for highly sensitive workloads)

4. Codebase & Deployment Security

Why It Matters:

  • If someone compromises your code or deployment pipeline, they control your app.

My Playbook:

  • Use private Git repositories with 2FA enabled.
  • Use environment variables for credentials, not hard-coded secrets.
  • Use secret managers (or even just well-secured .env files locally).
  • Review 3rd-party dependencies regularly.
  • Limit access to production systems.

Tools:

  • GitHub (with 2FA + branch protection)
  • Doppler or Vault for secret management
  • Dependabot for dependency monitoring

5. Financial & Account Security

Why It Matters:

  • Many solo builder attacks start by targeting your financial services and vendor accounts.

My Playbook:

  • Use unique passwords everywhere (no exceptions).
  • 2FA on every financial account.
  • Use a dedicated business bank account, not your personal one.
  • Monitor accounts for unusual activity regularly.
  • Use virtual cards for vendor subscriptions (limits blast radius).

Tools:

  • 1Password or Bitwarden for password management
  • Wise or Mercury for business banking
  • Privacy.com for virtual cards

The Human Reality: You’re the Security Team

This isn’t about achieving perfect security. It’s about:

  • Building good muscle memory.
  • Automating what you can.
  • Being aware of where you’re exposed.
  • Knowing which risks are existential vs. which are acceptable.

Most breaches happen because people get sloppy. The tools are available to us as solo builders. The hard part is building habits.

What This Means for Solo Builders

  • ✅ You don’t need enterprise-level SOC 2 certifications to be responsible.
  • ✅ You do need strong hygiene across your stack.
  • ✅ You can be aggressive with AI tools if you respect clear boundaries.
  • ✅ You can scale securely without losing your speed advantage.

Next Steps You Can Take Today

  1. Enable 2FA on every account you control.
  2. Create a simple security playbook checklist for every new project.
  3. Review your AI tool usage against the privacy cheat sheet.
  4. Audit your DNS, registrar, and domain protections.
  5. Start small, but build the habit. It’s cheaper than cleaning up a breach.

Security isn’t a blocker. It’s part of how you earn the right to keep building.

With this playbook, you’re not invincible—but you’re dramatically less likely to be blindsided.