Blog
A Security Review Checklist for DX Vendors (The One We Hope You Use on Us)
Questions platform security teams should ask any developer-inbox or SDK-probe vendor: keys, RLS, AI subprocessors, ticket automation, and honest compliance status.
2026-09-27 · 9 min read · AethelLayer
Start with blast radius
What can a leaked ingest key do? Write threads, burn quota, fire watch emails. It should not read another customer’s inbox. Ask whether ingest and read paths share a god key. Ours do not: ingest is the org API key; the dashboard is Auth + RLS.
Ask whether tickets auto-file
A vendor that opens public GitHub issues for every Docker OOM will train your engineers to ignore bots — and will paste stacks into a public tracker. Prefer draft-then-approve. Agents propose. Humans ship.
Map optional AI as a subprocessors decision
If summaries leave the boundary, that is a DPA conversation. If AI is off unless the customer brings OPENAI_API_KEY, say so. Optional is not the same as default-on with a buried checkbox.
Refuse fake badges
SOC 2 in progress is a program. SOC 2 certified is an auditor’s letter. SSO on the pricing grid as 'yes' when it is actually a sales ticket is also a finding. Use our security page as the template we are willing to be scored against.
Keep reading
Capture the failure before they leave
Capture the failure before they leave. Book early access or talk to sales, then install @aethellayer/sdk when you are onboarded.