3 ms·

Hey there, I wanted to offer you some unsolicited advice. You're building a security product, so you have an uphill battle ahead of you. There is a reason sec

Hey there, I wanted to offer you some unsolicited advice. You're building a security product, so you have an uphill battle ahead of you. There is a reason security engineers get paid more than any other engineer, and why security companies can charge more -- because security is fraught with peril and just a single mistake can ruin your company/career. You need to show that you are extremely competent at security -- more so than anyone I can hire myself. You also need to show that you care deeply about security. For example, the fact that you lock SSO behind a paywall says that you don't care about security. Yes, SSO tends to be an enterprise ask, but it's also important for two person companies. I'd suggest changing at least that part to be 10+ SSO users or something like that, and make the first few free. Also, your response to security reports in this thread is not what I'd want from a security company. Sure, the right way to report these things is via email, but you should still be grateful for the free security audit you got and approach that with a bit more tact. At least make it look like you care more about security than revenue and adherence to policy. Good luck, it looks like an interesting product, just make sure you don't turn users off with your security posture.

dangtony98 4y ago
Thanks so much for this comment - very valuable insights. RE security: 100% agree with everything you said. This is at the end of the day a security product. Even though we're very early, we've put a ton of thought into the security and especially the cryptography behind our product (e.g. we decided E2EE since the start) and intend on maximizing security posture in the coming months and years ahead — earning trust will definitely be an uphill battle but we hope to do it and have an optimal solution for everyone. RE SSO: Initially, we started by exploring what other solutions on the market are doing about this and noticed SSO as an enterprise ask even for security products like Bitwarden. That said, I think you have a great point here that I'll discuss with the team: SSO doesn't have to be available/not available across plans but that it could be available across all plans and larger organizations would need to pay for it anyways on the basis of needing it for more users — this preserves the SSO benefit for individuals and small teams as well as enterprises. PS: I'll work on doing a better job responding to security reports; I appreciate everyone's input a lot in this thread and hope to express that better over writing...
- plasma 4y ago
  +1 to providing SSO to smaller plans, hard requirement for me. I manage small teams and it would be a requirement for us, and if pricing for a few users is $14/month, normally enterprise is higher than that and an annual commitment, but you wouldn’t be able to get much budget out of me at this moment due to team size, but there is some there. When choosing tools like this, I pick ones I can grow with so I don’t need to solve it again in the future, so while the team may be small, it can’t adopt it if I cant start from that point.
  - dangtony98 4y ago
    Mhm I'll definitely look over SSO and talk to the team about including it in the lower plans as it would definitely be useful for smaller teams as well.
avarun 4y ago
> There is a reason security engineers get paid more than any other engineer dubious claim

dangtony98 4y ago

Thanks so much for this comment - very valuable insights. RE security: 100% agree with everything you said. This is at the end of the day a security product. Even though we're very early, we've put a ton of thought into the security and especially the cryptography behind our product (e.g. we decided E2EE since the start) and intend on maximizing security posture in the coming months and years ahead — earning trust will definitely be an uphill battle but we hope to do it and have an optimal solution for everyone. RE SSO: Initially, we started by exploring what other solutions on the market are doing about this and noticed SSO as an enterprise ask even for security products like Bitwarden. That said, I think you have a great point here that I'll discuss with the team: SSO doesn't have to be available/not available across plans but that it could be available across all plans and larger organizations would need to pay for it anyways on the basis of needing it for more users — this preserves the SSO benefit for individuals and small teams as well as enterprises. PS: I'll work on doing a better job responding to security reports; I appreciate everyone's input a lot in this thread and hope to express that better over writing...

plasma 4y ago
+1 to providing SSO to smaller plans, hard requirement for me. I manage small teams and it would be a requirement for us, and if pricing for a few users is $14/month, normally enterprise is higher than that and an annual commitment, but you wouldn’t be able to get much budget out of me at this moment due to team size, but there is some there. When choosing tools like this, I pick ones I can grow with so I don’t need to solve it again in the future, so while the team may be small, it can’t adopt it if I cant start from that point.
- dangtony98 4y ago
  Mhm I'll definitely look over SSO and talk to the team about including it in the lower plans as it would definitely be useful for smaller teams as well.

avarun 4y ago

> There is a reason security engineers get paid more than any other engineer dubious claim