{"id":988637,"date":"2026-10-06T17:00:00","date_gmt":"2026-10-06T17:00:00","guid":{"rendered":"https:\/\/croncodestudio.com\/en\/?post_type=croncode_post&p=988637"},"modified":"2026-09-08T22:58:43","modified_gmt":"2026-09-08T22:58:43","slug":"security-questions-before-you-sign","status":"publish","type":"croncode_post","link":"https:\/\/croncodestudio.com\/en\/journal\/security-questions-before-you-sign\/","title":{"rendered":"Security Questions Before You Sign"},"content":{"rendered":"
\n

Security questions belong in the same week as the quote, not after the first production key leaks into Slack. You are hiring a team that will see your repo, your store, and maybe your users. At Croncode<\/a> we expect to answer these. We also ask them of you. This is not a pentest report. It is the minimum paper. Handover later uses the same list: handover<\/a>.<\/p>\n

\n

Before you sign, ask where secrets live, who holds Apple roles, what data classes exist, and how access ends. A vibe and an NDA are not a security review.<\/p>\n<\/blockquote>\n

What should you ask about accounts?<\/h2>\n
    \n
  1. Who is Apple Account Holder? Ownership<\/a>.<\/li>\n
  2. Where do signing certificates and push keys live?<\/li>\n
  3. Which company emails have Git and host admin?<\/li>\n
  4. What is the offboarding step when a person leaves?<\/li>\n<\/ol>\n

    Istanbul diligence includes entity and overlap: hiring checklist<\/a>. References: check references<\/a>. We are Croncode LLC in Albuquerque, not croncodetech.com. Identity<\/a>.<\/p>\n

    What should you ask about data?<\/h2>\n\n\n\n\n\n\n\n\n
    Class<\/th>\nAsk<\/th>\nRelated<\/th>\n<\/tr>\n<\/thead>\n
    Photos, journals, bookings<\/td>\nWhere stored, who can export<\/td>\nDeletion<\/a><\/td>\n<\/tr>\n
    Analytics IDs<\/td>\nWhich SDK, why<\/td>\nAnalytics<\/a><\/td>\n<\/tr>\n
    Model prompts<\/td>\nLogged or not<\/td>\nFail-safe AI<\/a><\/td>\n<\/tr>\n
    Staff tools<\/td>\nSame binary or not<\/td>\nShared codebase<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Creep line: personalization<\/a>. Brief: AI brief<\/a>.<\/p>\n

    When is an NDA enough?<\/h2>\n

    Never as the only control. An NDA does not rotate a key. It does not remove a personal Apple Admin. Put access and deletion clocks in the statement of work. Commercial shape: fixed price vs retainer<\/a>. Quote packet: what to send<\/a>.<\/p>\n

    People who will be on paper: Goktug Unver<\/a>, Yusufhan Sokur<\/a>, Ozgur Ismet Ozkan<\/a>. Do not invent extra staff. Roster: meet the team<\/a>.<\/p>\n

    How do consumer apps change the questions?<\/h2>\n

    Ask whether the studio\u2019s own apps follow the same rules. Ours are separate listings: YourStyle<\/a>, Numira<\/a>, Spylie<\/a>, Luviport<\/a>. We do not share a client user graph with them. Catalog: what Croncode builds<\/a>. What we refuse: will not build<\/a>.<\/p>\n

    What answers should make you walk?<\/h2>\n