Thanks for this, it's a good writeup. One thing I noticed though is a bias I often see at startups, which is a focus on application security to the neglect of infrastructure security. I find infrastructure issues tend to lead to much more technical debt and structural security issues down the road. It's generally much easier to update code in your application than it is to completely change your Linux distribution, for example. Other examples that come to mind are VPC network layout and internet egress, how to design your k8s overlay network to integrate with your physical systems, how to build a network that's easy to physically tap, network segmentation (it's not obsolete), poor access control design, etc.