How we build secure software.

We’re committed to building high-quality, secure software for our customers and the people who book with them. This is our secure software development life cycle (SSDLC): how we keep quality high as we ship changes.

Last updated January 23, 2023

Planning and analysis

  • We track all development projects and tasks in Linear.
  • We link projects to related customer conversations, which usually live in Help Scout.
  • For complex features, product management writes detailed requirements and attaches them to the Linear ticket or project.
  • Project leads and task assignees are designated in our project management software.
  • Projects are planned and tracked on Linear roadmaps.

Design

  • Developers work with product management to map out data flows and storage for new features.

Development

  • Features are prototyped on feature branches.
  • Work-in-progress branches go up as GitHub pull requests early, for peer review and visibility.

Testing

  • Developers practice test-driven development, writing unit, functional, and integration tests for every feature.
  • Continuous integration (CI) runs on every commit, using GitHub Actions.
  • CI runs linters (credo), static type checking (dialyzer), code formatting (mix format), dependency vulnerability scanning (mix_audit), and the test suites.
  • We keep a test and staging environment for manual QA testing.

Deployment

  • We practice continuous deployment (CD): changes deploy when they’re merged into the main branch on GitHub.
  • GitHub Actions deploys code to our hosting provider only after every automated check passes.
  • New features often ship behind a feature flag before they roll out to all customers.
  • We instrument key features to track how they’re used.

Maintenance

  • Honeybadger monitors errors continuously, so we can spot bugs quickly.
  • Every developer is notified when an error happens in production.
  • We follow up with customers we know ran into an error in production.