Make a Security Strategy

[johnml1135]

What are we securing? How is it being secured? We need to review and document our approach, assumptions, and measures taken to ensure security.

[davidbaines]

I had a couple of questions about security:
Will we continue to use AWS S3 in production? I imagine that the security offered there is sufficient for our needs. How do we test that assumption?

Will each project have its own credentials?
Can we be confident that access to one project does not give any way of discovering other projects on the server?
Leaked credentials from one project (such as in an error report) would not affect the security of any other project.

[johnml1135]

@davidbaines - let's continue the discussion here: https://docs.google.com/document/d/1v8DinUykj2IA30TloNN6kUzdned4NOmArnBha0zWeog/edit

[johnml1135]

Completed enough for now.