Platform & security
Public marketing without leaking tenant data
Marketing must be discoverable; workspaces must be opaque. The failure mode is subtle: the same hostname, the overeager sitemap, the readiness endpoint that names too much, the login page that enumerates tenants, the compliance modal that trains muscle-memory dismissal. Good architecture is tedious—prefix routes, explicit allowlists, minimal public JSON, and auth responses that reveal nothing about what sits behind them.
Two products on one domain: boundary rules
If `/` and `/library` share a host, you must engineer crawler behavior as deliberately as routing. Marketing wants `index,follow`; vaults want `noindex` and tight `robots` complements.
Prefer path prefixes that humans understand: `/site/` or `/marketing/` for editorial; `/desk/` or tenant hosts for apps. Mental models reduce misconfigurations during fast deploys.
Canonical tags should never point crawlers at authenticated routes—even if you think they will bounce.
Separate deploy pipelines help: marketing content merges should not ship with the same adrenaline as vault auth hotfixes.
Robots, sitemaps, and cache poison
`robots.txt` is coarse; pair with per-template robots meta and HTTP headers where applicable.
Sitemap generators are a common leak: verify they only enumerate intentional public GETs, never admin or debug toggles added under pressure.
CDN caches occasionally capture error pages or challenge flows; define TTL and purge drills for auth shells.
Site access gates and marketing allowlists
Password or identity gates should enumerate what anonymous GET may pass—exact paths and bounded prefixes for editorial detail pages. Unknown slugs should 404, not authenticate, when you want SEO hygiene.
Under release pressure, teams paste ‘temporary’ exceptions—allowlists rot into implicit full-site holes. Review quarterly.
Readiness: fields worth publishing
Good public readiness answers: is the deploy alive, what coarse version, is synthetic monitoring green. It should not answer: which database minor version, which tenants exist, which third parties returned 500 to whom.
Move deep diagnostics behind authenticated ops roles or break-glass tokens with audit.
Treat readiness JSON like a press release: every field should survive being pasted into a client email without redaction panic.
Login UX and enumeration resistance
Uniform errors on authentication failures; avoid telling crawlers ‘tenant not found’ vs ‘bad password’.
Rate-limit and protect password recovery flows; they are marketing-adjacent and abuse-adjacent.
Cookies, sessions, and marketing-to-app bridges
Isolate cookie namespaces between purely public hosts and authenticated app hosts where architecture allows—accidental shared state makes ‘logout’ and ‘which tenant am I in?’ bugs harder to reason about.
Deep links that bounce from marketing into signed-in routes need explicit token hygiene: query-string auth tokens end up in logs, referrers, screenshots, and link unfurl caches—prefer short-lived exchange codes on dedicated paths.
SameSite and cross-origin rules drift over browser upgrades; regression-test login and OAuth handshakes quarterly, not ‘when someone complains.’
Compliance modals and desk switches
Bind attestations to verified identity and policy version, not to ‘every navigation’. Muscle-memory click-through is a legal and cultural liability.
When users switch desks, carry forward what the law allows and re-prompt only on material change.
Marketing copy vs product truth
Keep screenshots and claims aligned with shipped routes. Diligence teams diff marketing from demo tenants; gaps become trust defects harder to fix than code bugs.
Route public insights and calculators through the same release train as the app when you promise parity.
Unfurls, link previews, and accidental leakage
Slack, Teams, LinkedIn, and email clients prefetch URLs. A half-rendered authenticated page can leak titles or snippets if headers and meta tags are sloppy. Test unfurl behavior on staging with fake tokens.
Prefer conservative titles on challenge pages: ‘Sign in’ not ‘Acme Corp — Private LP Tear Sheet’.
Data residency and subprocessors in plain English
Your privacy page should match where marketing pages are rendered versus where desk data lives. Ambiguity invites procurement panic mid-deal.
CDN, WAF, and header baselines
HSTS, sensible CSP, and frame protections belong everywhere—including marketing—so a stray embed does not become a footgun. Document who owns header changes.
Tabletop scenarios that are worth a lunch
Accidental public listing of a private brief URL in sitemap; readiness JSON includes a secret; vendor misconfig exposes directory indexes; comms tweets a deep link to a signed-in-only page that partially renders in Slack unfurls.
Score detection time and runbook quality, not theatrical chaos.
Secrets, env parity, and ‘debug briefly turned on’
The deadliest leaks are accidental: a staging flag, a verbose error handler, a metrics sidecar copying sensitive labels. Treat debug as a radioactive token with TTL in every environment—including preview deploys tied to PRs.
Run a monthly automated scan for known secret patterns in public bundles; humans miss what grep catches.
Abuse: rate limits, bot management, and captcha posture
Marketing calculators can be farmed for batch requests or used as unwitting DDoS amplifiers. Put sane rate limits, geofencing where legal, and bot management in front of expensive endpoints.
Document fair-use in terms; block politely with machine-readable errors so clients can auto-retry sanely.
Red-team lite on public weekly releases
Each sprint, spend ninety minutes attempting: sitemap overshare, parameter injection on public tools, cache poisoning on error pages, and IDOR-ish deep links from emailed ‘preview’ hosts.
Incident communications template
Facts: scope, time discovered, customer impact class, containment in progress yes/no.
Unknowns: explicit list—credibility buys time.
Next update clock: wall time, not ‘soon’.
Avoid speculative attacker attribution in the first hour; focus on customer effect and mitigations.
Pre-write holding statements for the top three likely incidents so comms is editing, not inventing.
Assign a single incident commander for external voice; noisy multi-channel statements age poorly.
Public desk routes referenced above
Same URL discipline applies after you authenticate—bookmarkable paths, no tenant data on these pages.
- Platform framing How tenancy and public chrome split when SEO and auth walls must coexist.
- Guides Pair public guides with internal SOPs so training points at one narrative spine.
- Operating rhythm Template language for stages, owners, and completion rules in a mandatory morning loop.
- Public calculator hub GET-shareable patterns you can mirror for every material desk run; use as the pattern for replay links.
- Terms of use Stable legal URL when client-facing calculator links depart the marketing host.
- Privacy policy Maps subprocessors and flows; keep language consistent with how you split marketing and tenancy.
- Service status Public narrative around uptime; align its claims with what engineering will defend in postmortems.
- Readiness JSON Coarse liveness contract—use it to rehearse what is safe to expose anonymously vs behind auth.
- Sitemap XML Canonical index of what you intend to be crawled—diff it when generators change.
- Guided product tour Orient sponsors and new analysts on module boundaries before you encode them in a mandatory loop.
- Robots.txt Crawler contract at a glance; pair with per-page robots meta—treat changes like firewall edits.
Operator toolkits
Checklists and scripts you can lift into runbooks, vendor RFPs, or board appendices.
Security architecture note; validate against counsel, threat model, and insurer expectations.