- developers
- IT owners
- small businesses publishing web systems
Risk and trust
Software security
This hub is for teams that need practical security without turning every change into bureaucracy. It organizes dependency hygiene, secret handling, access review, pipelines, logs and the small routines that reduce operational risk.
- How to keep secrets out of repositories, logs and build artifacts.
- Which dependency and supply-chain checks matter for small teams.
- How to manage technical accounts, MFA and supplier access.
- How to improve security incrementally without freezing delivery.
Reading path
Start with the strongest context already available in the portal.
Some deeper references still point to Portuguese source articles while the full English migration continues. The English hub itself gives the decision map and the language relationship stays explicit.
Software security for small businesses
Portuguese overview of dependency and supply-chain risk.
Open referenceSupplier access and technical accounts
Portuguese guide about access ownership and offboarding.
Open referenceSecrets and environment variables
Portuguese guide about protecting credentials outside code.
Open referenceHow to use this hub
Treat this page as a decision map. The purpose is to help you name the problem before choosing a framework, vendor, refactor or automation. When the topic is clearer, the linked material becomes easier to interpret and compare.
The English migration is intentionally additive: the Portuguese portal remains stable, and each English page receives its own route, canonical URL and language alternates.
Terms to align before going deeper
FAQ
Common questions before acting on software security.
What can a small company do first to improve security?
Review access, enable MFA, separate secrets from code, update dependencies, test backups and remove sensitive data from logs.
Are environment variables enough for secrets?
They are better than committing secrets, but they still need access control, protected files, safe logging and rotation when exposure is suspected.
Why does supply-chain security matter to small systems?
Small systems still depend on libraries, build tools, containers and pipelines. A vulnerable dependency or exposed token can affect production regardless of company size.
Continue by theme