Security Champions: Building Plugin Safety Culture on a Small Team

--
title: "Security Champions: Building Plugin Safety Culture on a Small Team"
description: "--- Security Champions: Building Plugin Safety Culture on a Small Team. Most teams treat a plugin decision as a personal one, which is why plugin safety culture never forms."
tags: ["security", "champions", "building", "plugin"]

canonical_url: https://dshquality.com/blog/plugin-security-culture-champions

Security Champions: Building Plugin Safety Culture on a Small Team. Most teams treat a plugin decision as a personal one, which is why plugin safety culture never forms. A security champion program fixes that by handing one person per team named ownership instead of a policy nobody opens twice.

Why a policy document is not a culture. Every team that has tried this has written the document first. It rarely changes anything, for three reasons that have nothing to do with the writing.

Security champion responsibilities, concretely. Five things, and none of them require a security background. - Own the plugin list.

What a champion does each week. | Task | Time | Output |
|---|---|---|
| Review new plugin requests | 15 min | Approve, deny, or ask for a score first |
| Scan the installed list | 10 min | Any grade change flagged, direction noted |
| Check the allowlist | 5 min | Unused entries removed |
| Write one note | 10 min | What changed and why, in the repo |

Forty minutes a week. Teams that let this grow past an hour usually lose the champion by the second quarter, because the role quietly becomes a second job.

The part worth keeping: The first month decides whether the role survives. Full write-up is on the source blog.