May 2020 Summaries

As startup founders, it's essential to strike a balance between being scrappy in the early stages and prioritizing good security at the core of company culture. This means automating sensitive data handling processes, rather than relying on manual, unscalable approaches. Using third-party services like secrets managers can provide robust security without the risks and costs associated with building in-house solutions. However, if being scrappy is necessary, it's crucial to do so responsibly and use tools that minimize headaches, such as secrets managers, to avoid potential pitfalls like sharing sensitive data over email or using .env files.

Building an in-house secrets manager service can be a costly endeavor for startups, requiring a minimum of 3-4 engineers working full-time for at least 2 months. The solution is not a one-and-done fix and will likely require rebuilds as the company grows. In addition to engineering costs, liability and coverage of data breaches increase with team size and growth, resulting in rising security compliance standards and potential costs of $30,000+ per month. Alternatives include having engineers manage secrets themselves, which is error-prone and costly, or using plug-and-play services like Doppler that offer scalability, security, and compliance built-in at a significantly lower cost.

As a new startup, Doppler faced trust issues with potential customers due to its limited funding, small team, and lack of software security background. To address this, they integrated Radar, a secrets scanning tool that works with GitHub, which initially generated demand for their product but later became an undifferentiated cost center. However, as the market shifted towards increased focus on software security, Doppler's secrets manager gained popularity, leading to organic demand from new customers and loyalty from existing ones. To correct its journey, Doppler will discontinue Radar on June 1st, reassigning resources to its growing secrets manager product, with plans to continuously expand its offering.