If you maintain a project alone, spend one weekend on eight jobs: lock down your accounts, publish a security policy, open a private reporting channel, cut workflow permissions, protect release tags, plan your releases, recruit a backup, and check your dependencies. Together they cover the failures that hurt solo projects most.
Saturday morning: accounts
1. Two-factor authentication with a hardware key, and recovery codes. Your publishing accounts are the project. Register two keys and store recovery codes in a password manager. See recovery codes and backups and ranking 2FA methods.
2. Remove long-lived publish tokens where your registry supports a safer route. Read npm maintainer account security.
Saturday afternoon: intake
3. Write SECURITY.md with a contact, a supported versions table and a response promise you can keep. See writing one and the supported versions section.
4. Turn on private vulnerability reporting. It gives reporters a private route and you a tracked inbox. See how to enable it. Save the first reply template somewhere handy.
Sunday morning: pipeline
5. Cut workflow permissions. Set the default token to read-only and grant write only to the jobs that need it. See least privilege token permissions. Require approval for workflow runs from forks, as in the fork approval checklist.
6. Protect release tags and branches. Add rules so tags cannot be moved or deleted and the main branch needs review. See protecting release tags and branch protection rules.
Sunday afternoon: people and dependencies
7. Find a backup person. Ask one trusted contributor or peer to be a second reviewer and a second security contact. See two-person review when you are the only maintainer and adding a co-maintainer.
8. Look at your own dependencies. List what your project pulls in, and check for known issues and abandoned packages. A short review now beats a surprise advisory later.
Try it yourself
Open the demo to see continuous monitoring watch a dependency set for new problems. Look at how a new advisory shows up against a package you already use, which is the signal you want after the weekend is over.
Click through it at your own pace, or open it full screen.
What to skip this weekend
Do not start with a bug bounty, a certification effort or a rewrite. Those matter later. The eight jobs above are about making one bad day survivable.
Keep it alive
Put a recurring reminder in your calendar, once or twice a year, to review the list. People leave, tokens age and settings drift.
Safeguard can scan a project's dependencies and flag known issues, and there is a free scan at gold.safeguard.sh/scan if you want a quick look at task 8.
Quick check
Which of the eight matters most?
Account protection. If your publishing account is taken, every other control is bypassed.
Can I really do all of this in a weekend?
Most settings take minutes each. Finding a backup person may take longer, so start that conversation first.
Last reviewed: 19 October 2026.
