Code can be messy. Security can't.

The report was a quick win. Sales wanted a list of last month's customers, so an engineer exported one in ten minutes and dropped it in the team chat.

Names, phone numbers, addresses, what each person bought.

Everyone said thanks. Nobody thought about it again. Until a few months later, when someone noticed that chat group had grown to include two freelancers and a partner agency. The file was still there, one scroll away, for anyone who joined.

Nothing bad happened. We were lucky. But luck is not a security plan.

Messy code is fine. Leaky data is not.

I'm relaxed about a lot of things when a team is moving fast. A rough first version, a hacky script, a page that only works on Tuesdays. Messy code can be cleaned up next week.

Data is different. Once customer data leaks, you can't refactor it back. You can't roll it back. The trust is gone, and it doesn't come back with a hotfix.

So my rule is simple: code can be dirty, but security can't.

Treat data like it belongs to someone

Because it does. Every row in your database is a real person who trusted you with something.

Collecting data is easy. Looking after it is the real job. A few habits make most of the difference:

• Collect less. If you don't need a field, don't store it. Data you never collect can never leak.
• Give the smallest access that works. Not everyone needs the whole database. And when people leave a team, their access should leave too.
• Keep real data out of test and dev. Use fake or masked data. Laptops get lost. Staging gets forgotten.
• Keep secrets out of code. Passwords and API keys belong in a proper secret store, not in a repository or a chat message.
• Think before you share. A spreadsheet in a chat group is a copy you no longer control.

None of these need a security team. They need everyone to care a little.

The new leak: pasting into AI

There's one more habit that matters more every day.

AI tools are wonderful, and I use them constantly. But it's very easy to paste a customer list, a log file full of emails, or a production config into a chat box to "just ask a quick question".

Before you paste, ask: would I be comfortable if this text ended up somewhere I can't see? If not, remove the personal details first, or use a tool your company has approved for that data.

Build trust, not just features

Customers rarely see the security work. Nobody writes a thank-you note because their data wasn't leaked.

But they feel it. They feel it in the confidence to share their details, to come back, to recommend you to a friend.

That trust takes years to build and one careless click to lose.

Move fast with the code. Move carefully with the people behind the data.