Quick checklist that saved us time. Rotate credentials on a calendar, not only after incidents. Use feature flags generously for safe tests.