What you will learn
- Least privilege
- Credential rotation
- Dependency risk
- Data access boundaries
Least privilege
Least privilege grants only the access needed for a task. A research process generally does not need account-trading authority to read historical data. Separating permissions limits the consequences of an error or compromised component.
Credential rotation
Credential rotation and revocation need a tested procedure. Know which services use a secret and how to replace it without exposing values in logs. Lost or suspected-compromised credentials require a documented response.
Dependency risk
Dependencies introduce supply-chain and maintenance risks. Track versions and relevant changes, and avoid executing unreviewed code merely because it appears in a tutorial. Reproducibility and security both benefit from explicit dependency management.
Data access boundaries
Data access boundaries separate public research, account records and sensitive credentials. Export only what a reviewer needs, with personal identifiers minimized where appropriate. A private repository is not a reason to place secrets in source files.
Worked example
A backtest notebook contains a live trading key even though it only reads a local CSV. Removing the unused privilege reduces the harm possible from an accidental call or leaked notebook.
Try it yourself
Design separate permissions for data ingestion, research and execution, and identify how a reviewer can reproduce a study without receiving trading credentials.
Show the worked solution
Give each component only its required capability. Provide approved data access or reproducible files and configuration descriptions to the reviewer; keep execution authority and secret values outside the research package.
Apply this to your course project
Submit an approval, rollback and incident-evidence package for a hypothetical model change.
Keep the calculation inputs, assumptions and decisions with your work. Practical exercises are self-reviewed; the scored knowledge checks assess the questions shown, not an independent certification of practical competence.