Security is a product decision
Security done as a final checkbox always loses to the deadline. I bring it into the roadmap early, with threat models, data handling and key management as requirements, not last minute audits. In Web3 especially, a breach is not a bug, it is the end of the story.
Know your CSIRT before the incident
The worst time to figure out who does what is during an incident. I make sure there is a defined response path, who triages, who communicates, who has authority to act, so a real event runs on a rehearsed plan instead of panic.
Least privilege, by default
Most breaches exploit access nobody needed. I push for least privilege as the default posture, with narrow permissions, short lived credentials, and regular reviews of who can touch what. It is unglamorous and it prevents whole categories of incident.
Audits are a floor, not a finish line
A passed audit means you met a baseline on a given day, not that you are safe forever. On blockchain products I treat external audits as one gate among many, alongside continuous monitoring and a real bug bounty culture.
Real example
On the Datachain bridge, security was the program's central risk, not a side task. Audit readiness, key management and testnet hardening were tracked as first class deliverables with named owners, because on a cross chain settlement layer, the security posture is the product.