DEV Community: Rajat Jain

7 security questions to ask before giving an offshore team repo access

Rajat Jain — Sat, 31 Oct 2026 08:12:48 +0000

Giving people outside your building access to source code is a fair thing to worry about. The risks are specific, though, and most of the controls are the ones you should already apply to any remote employee.

Before the first engineer gets access, ask the provider these seven questions. Vague answers are worth following up in writing.

Who employs the engineers? Do they sign individual NDAs and IP assignment terms that name your company?
Are devices company-owned and managed? Can they show that encryption and remote wipe are enforced?
Can your identity provider control all access? You should be able to revoke it without asking them.
Certified or aligned? ISO 27001 certification comes from an accredited body, and a SOC 2 report comes from a CPA firm. "Aligned" means neither has happened. Ask for the certificate, the report or the control list.
What happens to code and data when the engagement ends? How is deletion confirmed?
Who do you call during a suspected incident? How quickly will they respond?
How is the office secured? Ask about physical access and visitors on the delivery floor.

What to configure on your side

Protect main branches and require at least one approval.
Scan every pull request for vulnerable dependencies and leaked secrets.
Keep credentials in a secrets manager, and rotate any secret that reaches a commit.
Remove standing production access. Changes go through the pipeline, and break-glass access is time-bound and logged.
Use synthetic or masked data in development.

Our own position, for comparison: controls aligned with ISO 27001 and SOC 2, not certified.

The full checklist covers contracts, monitoring, the DPDP Act and EU data transfers: https://offshore1st.com/blog/ip-protection-data-security-offshore-teams-checklist

Disclosure: I'm the founder of Offshore1st, which places dedicated staff in India. This post was prepared with AI assistance and is condensed from our checklist.

India doesn't change its clocks. Here's what that does to your offshore team's overlap

Rajat Jain — Sat, 31 Oct 2026 06:39:05 +0000

US clocks go back an hour on Sunday 1 November. India's never move, so every team working between the two loses an hour of shared time on Monday.

Here's the overlap we plan around, for a client working 09:00 to 18:00 local time and a team in Hyderabad on a matched shift.

Client city	Team hours (IST)	Daily overlap
New York	14:30 to 23:30	4 hours in US winter, 5 in summer
London	11:00 to 20:00	5½ hours in UK winter, 6½ in summer
Dubai	10:00 to 19:00	About 8½ hours all year
Sydney	07:00 to 16:00	5½ hours in the southern summer, 6½ in winter

New York is the tightest window. In US winter, 09:00 Eastern is 19:30 in Hyderabad, so shared time runs from 19:30 to 23:30 IST.

This week's checklist

Move recurring meetings so they still land inside the overlap.
Check any handoff that relies on someone seeing it before they log off.
Decide whether the shift moves with your clocks or stays put, and confirm it in writing.

Protect the overlap

Don't spend it on status. Post a written standup at the start of each person's day, with four lines: yesterday, today, blockers and FYI. The required blockers line matters most, because it makes raising a problem routine.

Use the shared hours for decisions, pairing and design reviews. Before logging off, each side writes down what finished, the exact state of what's in progress, open questions with a named owner, and what the other side should pick up first.

Write messages that don't need a reply

Incomplete: "The users API is broken."
Complete: "GET /api/users returns 500 with an expired token. Expected 401. I suspect the error handler. Draft fix in PR 412. Needed before Thursday's release."

Each clarifying question can cost half a day, so that second version pays for itself.

The full guide covers operating models, response-time targets and how to measure whether the system works: https://offshore1st.com/blog/complete-guide-managing-offshore-teams-time-zones

Disclosure: I'm the founder of Offshore1st, which places dedicated staff in India. This post was prepared with AI assistance and is condensed from our guide.

Which websites do AI assistants cite? We asked 12 buying questions

Rajat Jain — Tue, 20 Oct 2026 18:32:47 +0000

We asked an AI assistant with live web search 12 questions buyers really ask, from accounting software to health insurance, and recorded every website it cited. Across 12 answers it cited 97 different sites, and only two came up more than once. Here is what that means for getting your brand into AI answers.

How was the study done?

On 20 October 2026 we asked Claude (Opus 5.5) each question once, with web search on, using the same setup as SellHax's free AI check. We recorded the domain of every source it cited and grouped them into five kinds: the company's own website, review and comparison sites, small blogs and niche sites, established media, and community platforms.

It is a small sample: one assistant, one run per question, 12 questions, 9 of them about India. Answers change between runs and between assistants, so read the numbers as a pattern, not a ranking.

What kinds of sites were cited?

Companies' own websites: 49% of citations, and at least one in every answer.
Small blogs and niche sites: 20% of citations, in 10 of 12 answers.
Review and comparison sites (Capterra, Techjockey, Policybazaar, BikeDekho, Careers360 and others): 18%, in 9 of 12 answers.
Established media (Forbes, TechRadar, Tom's Guide, Search Engine Land): 6%, in 5 of 12 answers.
Community platforms (Quora, Medium, dev.to and others): 6%, in 5 of 12 answers.

Do you need to be on famous sites?

Not in this sample. Big-name media made up about one citation in 16. Small, focused blogs and review sites were each cited about three times as often, and they are far easier to get featured on.

Does every category have its own sources?

Yes. 97 different sites across 12 answers, and only two (onlinenifm.com and techradar.com) appeared in more than one. There is no single site that gets you into AI answers everywhere; you need the handful that matter in your category, which is why asking your own customers' questions is the first step.

Do Indian questions get Indian sources?

Largely. Of the 97 sites, 55 were Indian or India-focused, and the Indian questions were answered mostly from Indian review sites, blogs and companies. A brand selling in India is better served by coverage on sites Indian buyers read than by a global wire.

What should a brand do with this?

Make your own site citable: a plain description, pricing, and pages that compare you honestly. Companies' own sites were the most cited kind.
Get listed on the review and comparison sites for your category.
Get featured on the niche blogs and publications your category's answers already cite, rather than chasing famous names.
Check your own questions: the sources differ for every category.

What was cited for each question?

Best accounting software for small businesses in India: aiaccountant.com, capterra.in, catusharmakkar.com, enkash.com, gimbooks.com, onlinenifm.com, profitbooks.net, taxone.vyapar.com, techjockey.com.
Best project management tool for a small remote team: dailyvanguard.com, dev.to, kanbanchi.com, project-management.com, smartsuite.com, softwarefinder.com, thedigitalprojectmanager.com, wrike.com.
Best payment gateway for a startup in India: claudecms.com, designingjunctions.com, dhanaay.com, growwwtech.com, henindia.com, shop2host.com, startupbricks.in, storeengine.pro, xflowpay.com.
Best credit card for travel rewards in India: 1finance.co.in, cardexpert.in, creators.spotify.com, indiabonds.com, medium.com, moneyview.in, surmaiduniya.com, tripcabinet.com, wise.com.
Best health insurance plan for a family in India: fincover.com, forbes.com, insurancedekho.com, joinditto.in, nyvo.in, onsurity.com, policybazaar.com.
Best online course platform to learn data science in India: bmuonline.org, careers360.com, collegedunia.com, learn.modernagecoders.com, logicmojo.com, news.careers360.com, scaler.com, trainingskart.com, upgrad.com.
Best CRM for small businesses: brevo.com, capterra.com, croclub.com, fayedigital.com, gohighlevel.com, nimble.com, techradar.com.
Best electric scooter to buy in India: bajajfinserv.in, bikedekho.com, e-vehicleinfo.com, ekotejas.in, evindiaexpo.in, opgmobility.com, quora.com, zigwheels.com.
Best website builder for a small business: block.fiverr.com, launchthedamnthing.com, mailerlite.com, optinmonster.com, sitebuilderreport.com, techradar.com, tomsguide.com, websitebuilderexpert.com.
Best HR and payroll software in India: darwinbox.com, eklavya.com, employwise.com, infowan.net, kredily.com, peoplestrong.com, salarybox.in.
Best app to invest in mutual funds in India: chittorgarh.com, creditkaro.com, fisdom.com, huggingface.co, invezz.com, joinfingrad.com, mymudra.com, onlinenifm.com, zfunds.in.
Best SEO tools for a small marketing team: aioseo.com, expressmedia.net, link-assistant.com, louvemarketing.com, networksolutions.com, poppymarketingandconsulting.com, searchengineland.com, selectsoftwarereviews.com, telescopemapping.com.

Originally published at sellhax.com.