Rethinking Browser Extension Development for the Modern Security Engineer

We adopted a writing culture where every significant technical decision gets documented in a lightweight RFC. These aren’t formal or bureaucratic — just a shared Google Doc with problem statement, proposed approach, alternatives considered, and decision rationale. Six months in, the archive has become our most valuable knowledge base.

Post-mortems without action items are just storytelling. We implemented a strict follow-up process: every post-mortem produces at most three concrete action items, each assigned to a specific person with a deadline. Items that don’t get done within two sprints get escalated or explicitly deprioritized.

We built a lightweight internal developer portal that aggregates service ownership, runbook links, API docs, and deployment status. It took one engineer three sprints to build using a static site generator, and it immediately became the first place anyone goes when an incident starts.

Our cost optimization effort started with the boring stuff: right-sizing instances, cleaning up orphaned resources, and switching to reserved capacity for predictable workloads. These unglamorous changes saved more than any architectural redesign would have.

Thank you to everyone who reviewed early drafts of this post and pushed back on the parts that were too vague or too self-congratulatory. The final version is much better for their honesty.