Safety Norms: Software Development and Full-Stack Engineering

11. Purpose, Scope, and Safety Principles

These norms apply to anyone who designs, writes, tests, deploys, or operates web and application software. This includes front-end interfaces, back-end services, databases, application programming interfaces, cloud infrastructure, build pipelines, and any development hardware such as test devices, embedded boards, or lab servers. The purpose is to prevent harm to workers, users, and the public, to protect personal and business data, and to keep essential services available.

Norms are labeled Mandatory where failure creates direct risk to people, data, or regulated obligations. Recommended items reflect good practice that local management may adapt. Requirements that depend on jurisdiction, including workplace ergonomics rules, privacy law, export controls, accessibility rules, and sector standards for safety-related software, must be verified with competent authorities or qualified professionals before they are relied on.

• Mandatory: no change reaches production without the review and approval defined in the change control procedure.
• Mandatory: software that controls physical equipment, medical functions, vehicles, or critical infrastructure follows the validation process approved for its sector.
• Recommended: design every system as if a fault could affect a user's health, finances, or access to essential services.

22. Roles, Competence, and Accountability

The engineering manager or product owner assigns work, confirms that training is complete, and approves release risk for each service. Engineers are responsible for the safety of their code, tests, and configuration, and they must stop work when a hazard is not controlled. The security lead and, where one exists, the data protection officer set information safeguards. Facilities staff own building electrical systems, cooling, fire suppression, and physical access to server rooms.

Competence is shown through documented experience, supervised practice, and training on the tools and environments used. Engineers do not open power distribution equipment, work on high-voltage test benches, or modify industrial controllers unless the facility owner has authorized them and qualified personnel are present. Privileged cloud roles, production database write access, and secrets management rights are granted to named individuals, time-limited where practical, and recorded.

• Mandatory: every production service has a named owner who is accountable for its safe operation.
• Mandatory: privileged access requires written approval and periodic revalidation by the access owner.
• Recommended: new engineers shadow production-adjacent tasks for an agreed period before taking on-call duties.

33. Course-Specific Hazards and Risk Assessment

Physical hazards include musculoskeletal strain from prolonged keyboard, mouse, and screen use, eye strain from poor lighting or glare, trip hazards from loose cables, and electrical hazards from damaged power strips, worn chargers, and lithium battery devices. In hardware labs and server rooms, additional hazards include high voltage, uninterruptible power supplies that remain energized after shutdown, heavy rack equipment, hot exhaust air, and the noise and pressure of fire suppression discharge.

Digital and process hazards include production outages, data loss from failed migrations, unauthorized disclosure of personal data, and software that influences physical processes such as building controls or vehicle functions. Human factors are significant: fatigue from on-call work, deadline pressure, and rushed hotfixes often cause incidents. Each hazard should be rated low, medium, or high by likelihood and severity, with the control owner and review cycle recorded in the risk register.

• High: changes to production data, authentication, payment logic, or safety-related control logic.
• High: on-call work that exceeds the hour limits set in the rota policy.
• Medium: deployments to shared environments without a tested rollback plan.
• Low: minor interface defects in internal tools with no access to personal data.

44. Preventive Controls and Safe Work Practices

Defects are prevented through layered controls: peer review of every change, automated tests that must pass before merge, static analysis, dependency vulnerability scanning, and staged releases using feature flags. A release permit is the controlling document for production change. It records the scope, affected services, test evidence, data migration steps, rollback or forward-fix plan, approving engineer, and on-call contact. Schema migrations run first against a production-shaped environment that contains masked or synthetic data, and they should remain backward compatible across at least one release unless an approved outage window applies.

Engineers must not deploy while impaired by fatigue, illness, or medication that affects concentration. Changes that alter safety-related behavior require validation evidence before release, and the release is blocked until that evidence is attached. Workstation practice also matters: adjust chair height, monitor position, and keyboard angle; take short breaks at intervals set by local policy; keep walkways and cable runs clear; and use approved chargers on surge-protected power. Damaged plugs, swollen batteries, or scorch marks must be removed from service and reported at once.

• Mandatory: all production changes require an approved release permit.
• Mandatory: migrations that delete or rewrite data require a verified backup before execution.
• Mandatory: no direct commits to protected production branches.
• Mandatory: damaged power equipment and swollen batteries are removed from use and reported to facilities.
• Recommended: use feature flags so functions can be disabled without a full redeployment.
• Recommended: rehearse common failure scenarios through scheduled game-day exercises.

55. Equipment, Environment, Information, and Protective Safeguards

Ergonomic safeguards include adjustable seating, monitor arms, external keyboards and pointing devices where laptop use is extended, headsets for long calls, and anti-fatigue mats where standing desks are used. Server rooms and lab racks need locked access, environmental monitoring for temperature and humidity, smoke detection, and suppression systems maintained by the facility owner. Personal protective equipment is not normally required at a standard desk, but where an engineer must work in a rack area or lab, the facility owner specifies any required protective equipment, such as eye protection or insulated tools, and the engineer uses it.

Information safeguards treat source code, configuration, logs, and test data as protected assets. Secrets must never be stored in repositories, tickets, or chat channels; an approved secrets manager is used instead. Logs must exclude passwords, tokens, and unnecessary personal data. Privacy obligations vary by jurisdiction and should be confirmed with a qualified privacy professional. Environmental controls include certified e-waste disposal for retired computers, monitors, and batteries, documented sanitization of storage media before disposal, and an asset register. Energy use should be managed by right-sizing compute resources, shutting down idle development environments, and scheduling heavy batch jobs where practical.

• Mandatory: no secrets in source code, tickets, or chat.
• Mandatory: no one opens power distribution, UPS, or fire suppression enclosures without facility authorization and qualified staff.
• Mandatory: retired storage media is sanitized or destroyed under a documented procedure.
• Recommended: review cloud resources regularly and decommission idle instances.

66. Incident, Near-Miss, Emergency, and Escalation Procedures

Severity levels are defined in advance. A severity one event includes confirmed or suspected personal data exposure, a safety-related malfunction, or loss of a critical service. It triggers immediate escalation to the incident commander and the security lead. Engineers report suspected breaches without waiting for confirmation. Near misses, such as a migration almost run against the wrong database, are logged in the same system as incidents so that recurring patterns can be identified and addressed.

Physical emergencies take priority over software recovery. For fire, smoke, electrical burns, flooding, or an injured person, evacuate if needed, call local emergency services, and follow the building emergency plan. Do not attempt to restore power or open electrical enclosures. Do not enter a server room where smoke or suppression discharge is present. Engineers without first aid training summon trained responders and do not improvise medical care. Notification duties to regulators or customers depend on jurisdiction and contract and must be checked with legal counsel.

• Mandatory: all incidents and near misses are reported promptly, with factual records and no blame.
• Mandatory: the incident commander decides on rollback, feature disablement, or customer notification steps, with legal input where required.
• Mandatory: severity one and two events receive a post-incident review with tracked corrective actions.
• Recommended: maintain a current contact list for on-call staff, facilities, legal, and key vendors.

77. Records, Training, and Inspection

Records include training completions, access grants, release permits, test results, risk register entries, incident reports, backup restore results, and asset disposal certificates. Records must be retrievable during an audit or investigation and kept for the period set by legal and contractual obligations, which varies by jurisdiction and must be verified locally.

Training covers secure coding, the release and rollback process, incident response drills, privacy basics, and workstation ergonomics. Facilities staff provide site-specific induction for any server room or lab. Inspections are carried out by the security lead and facilities team on a defined schedule. They review access logs, alarm history, and backup restore evidence. A restore test is meaningful only when the restored data is checked against expected results.

• Mandatory: backups are restored in a test environment on a defined schedule and the results are recorded.
• Mandatory: training is completed before privileged access is granted.
• Recommended: conduct blameless retrospectives and track action items to closure.

88. Monitoring, Review, and Continuous Improvement

Owners monitor indicators such as failed deployments, rollback frequency, alert volume, on-call hours, overdue access reviews, near-miss reports, overdue ergonomic assessments, and environmental alarm trends. Indicators are used to find weaknesses, not to rank individuals. Findings feed into updates to the risk register and training content.

This document must be reviewed after any severity one event, when new sector or privacy requirements apply, when new tools or hosting arrangements are adopted, and at the interval set by management. Engineers are invited to propose changes. Each proposed change is assessed for safety, privacy, and compliance impact before adoption, and the locally approved version replaces this starting point.

• Mandatory: norms are reviewed after every severity one event.
• Recommended: review this document at least annually and whenever the team changes its hosting or tooling.

Implementation checklist

• Confirm every production change has an approved release permit and a tested rollback or forward-fix plan.
• Verify that no secrets appear in source code, tickets, or chat logs.
• Confirm a verified backup exists before any data migration runs.
• Check that on-call hour limits and handover notes are being followed.
• Adjust workstation ergonomics and remove damaged power equipment from use.
• Confirm server room and lab access is limited to authorized people.
• Escalate suspected personal data exposure to the security lead immediately.
• Sanitize storage media and use certified e-waste channels for retired hardware.
• Verify jurisdiction-specific privacy, accessibility, and sector requirements with qualified professionals.
• Log every near miss and schedule its review with the responsible owner.