Developer platforms & services → start here
Reference guides for the hosting, cloud, and developer services behind custom applications — access, roles, secrets, and ownership.
- Difficulty
- Intermediate
Custom applications run on more moving parts than a typical website: a hosting platform, a database, a cache, file storage, an email sender, error tracking, and a pile of API keys holding it all together. This section is our reference for how access, ownership, and secrets work on each of them.
This section is for your developers, not for you
If you are here to give us access to something, you almost certainly want Giving Chykalophia access instead — start with the access directory (A–Z) and look up your tool by name. The pages below are technical reference material for whoever looks after your servers and code. Nothing here is required reading for a business owner.
Quick summary
These guides are generic reference material about each platform — how its roles work, how to add and remove people, how to rotate secrets, and how to transfer ownership. They are not specific to any one project. For access to a particular environment, ask your project lead.
If you only read three things
- The principles below — the rules that hold across every platform on this list.
- Managing environment variables & secrets — where most real incidents start.
- Transferring ownership to you — the conversation to have before you need it.
Principles that apply everywhere
The platforms differ; the rules don't.
The account belongs to the business, not an individual. Register on a shared, role-based address rather than one person's inbox. When that person leaves or loses access, everything they own becomes a recovery problem.
Use the least privilege that works. Nearly every platform here offers a read-only or developer-tier role, though on several of them the genuinely restricted tiers only exist on a paid plan. Admin and Owner should be rare and deliberate.
Invite people, don't share logins. A shared password can't be revoked for one person, can't be audited, and breaks two-factor authentication.
Secrets are rotated, not deleted. Removing someone's user account does not invalidate an API key they once created. Offboarding means rotating keys too.
Turn on two-factor authentication everywhere. Especially on the account that owns billing and DNS.
Hosting & deployment
Vercel
Teams, project roles, environment variables, and transferring a project.
Render
Workspace members, services, environment groups, and ownership.
Environment variables & secrets
Where secrets live, how to rotate them, and what never belongs in Git.
Cloud infrastructure
AWS accounts & IAM
Root accounts, IAM users and roles, and the few tasks that still need root.
Amazon S3
Bucket access, public-access blocking, and sharing files safely.
AWS KMS
Encryption keys, key policies, rotation, and the danger of deletion.
Data stores
Managed PostgreSQL
Database roles, connection strings, backups, and credential rotation.
Managed Redis
What Redis is used for, how access works, and why it isn't a database.
Application services
Sentry
Error tracking, organisation roles, DSNs, and scrubbing personal data.
SendGrid
Teammates, API key scopes, sender authentication, and deliverability.
ClamAV
Open-source malware scanning for uploaded files — no account required.
SurveyJS licensing
Commercial licence keys, seats, and keeping keys out of public code.
Mobile & tooling
Expo & EAS
Organisation roles, build credentials, and app store ownership.
Amazon Q Developer
AI code review in the developer's editor, and what it can see.
GitHub access
Repository access for source code, including organisation-owned repositories.
Related guides
- Giving us access, explained
- Access directory (A–Z)
- Why we ask for access (and why it's safe)
- Transferring ownership to you
- Revoking access after a project
- Team offboarding security
Need a hand?
Last updated