Getting over the finish line: Loom Security Journey.
summary
Timeline covers 2021–2023 security buildout at Loom: hiring the first security engineer, deploying AWS WAF as a timeboxed anti‑DOS project, running a mature bug‑bounty program that pays $170,000+ and triages 250+ reports, and building custom SAST rules plus a homegrown threat‑detection platform. A March 7, 2022 CDN caching misconfiguration returns other users’ session cookies, forces DB and cache rollback, blocks traffic with WAF, and impacts ~3,000 users; postmortems drive quarterly planning and tooling choices ahead of Atlassian acquisition.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 2:54Joining the security team
- 5:07Implementing security projects
- 7:51Scaling security programs
- 9:31Security operations and tools
- 14:10Case study of a major incident
- 20:14Bug bounty and collaboration
- 26:37Q&A session
related talks
45mHow Leading Companies Are Scaling Their Security
20mDeveloper’s security survival guide
36mThe Road To Being Rugged
34mEmbarking on Your Security Journey
52mContinuous Security
46mApplication security from start to finish
01h 00mBuilding Safe Systems at Scale - Lessons from Six Months at Yahoo
36mOvercoming Obstacles in Operationalizing Security