Developer Onboarding & Local Setup

How quickly a new engineer becomes productive and safe depends on onboarding. A smooth, documented setup, a buddy to ask, and a clear picture of how we work turns weeks of confusion into days. It also makes sure good habits (security, testing, our way of working) are learned from day one, not picked up by accident.

Onboarding is both kindness and risk management. A new joiner who cannot get the project running, does not know where things are, or is afraid to ask will be slow and may take unsafe shortcuts. Good onboarding gets them contributing safely and fast: a reliable setup guide, least-privilege access from the start, a buddy, and links to these guidelines. With a mostly-junior team, this is one of the best investments we make.

It is a two-way responsibility. The team provides the path and the support. The joiner is expected to read the guidelines, ask questions, and follow the standards from the start.

Make joining smooth and safe

• DoKeep an up-to-date getting-started guide: how to set up the dev environment, build, run, and test the project. Keep it current, as code (see Documentation as Code).
• DoGive new joiners least-privilege access through the proper process, and their own accounts and MFA from day one. Never a shared login (see Identity & Account Hygiene).
• DoSet up local development with safe, synthetic or masked data and dev-scoped secrets from the vault. Never use production data or secrets (see Test Data & Environments, Secrets Management).
• DoAssign a buddy or mentor and make it clearly safe to ask questions. Questions are expected, not a sign of weakness (see Collaboration, Continuous Learning).
• ConsiderGiving a starter task and some paired or shadow work early, so they learn our way of working (trunk-based, TDD, pairing) by doing it (see Trunk-Based Development).

What new joiners should do

• DoRead these guidelines, especially Security Essentials / Zero Tolerance, the way-of-working topics, and the gotchas for our stack, and apply them from day one.
• DoAsk early and often, rather than guessing or struggling alone. An hour of someone's time beats a week going the wrong way (see Communication).
• DoFollow the standards from the start (Definition of Done, coding standards, secure defaults). Building good habits early is far easier than unlearning bad ones.
• NeverTake a security shortcut (shared login, production data locally, a committed secret) just to "get set up". Ask for the proper way instead.

Self-review checklist

• AskCould a new joiner get the project running today from our written guide, without a veteran beside them?
• AskDo they have their own least-privilege access and dev-scoped secrets — no shared logins or prod data?
• AskDo they have a buddy and feel safe asking questions?
• AskHave they been pointed at the guidelines and our way of working?