# Security in the same ticket

Keep security, quality, and observability inside the feature ticket — not a separate phase.

## Ticket checklist
- [ ] Privilege and data access for this change reviewed
- [ ] Secrets / config not hardcoded; rotation path exists
- [ ] Failure and abuse cases considered for public surfaces
- [ ] Tests or checks cover the risky paths
- [ ] Deploy + rollback understood
- [ ] Signal exists if this breaks in production

## Principles
1. Same ticket, same owner
2. Threat notes, not theater
3. Gates in CI, not after launch
4. Observable by default

## Avoid
- Security as a separate project after months of feature work
- Junior-only security ownership without senior accountability
- Long policies that never appear in the PR template

---
From [NextEra Security](https://nexterasecurity.com/guides/security-in-the-same-ticket/) — free to copy.