Currently supported versions for security updates:

We take security seriously at Automation-Foundry. If you discover a security vulnerability, please follow these steps:

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, please email founder@nbr.company with:

1. Description: A clear description of the vulnerability
2. Impact: Potential impact and affected components
3. Reproduction: Steps to reproduce the vulnerability
4. Suggested Fix: If you have a proposed solution

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 1 week
• Regular Updates: Every week until resolved
• Resolution Timeline: Critical issues within 30 days

When using Automation-Foundry modules:

Always validate inputs before processing:

from workflow_engine import ValidationError

def validate_workflow_config(config: dict) -> None:
    if not config.get("tasks"):
        raise ValidationError("Workflow must contain tasks")
    # Additional validation...

Never hardcode secrets:

from secrets_identity_fabric import InMemorySecretStore
import os

secrets = InMemorySecretStore()
secrets.put("api_key", os.environ["API_KEY"])  # Good
# api_key = "hardcoded_secret"  # Bad!

Implement rate limiting for external-facing services:

from security_guardrails import RateLimitConfig, TokenBucket

config = RateLimitConfig(max_requests=100, window_seconds=60.0)
limiter = TokenBucket(config)

def handle_request():
    limiter.acquire()  # Will raise RateLimitExceeded if exceeded
    # Process request...

Enable comprehensive audit logging:

from audit_first_automation import AuditLogger, JsonlSink

logger = AuditLogger(JsonlSink("audit.log"))
logger.log(
    actor="founder@nbr.company",
    action="deploy",
    subject="production",
    outcome="success",
    metadata={"resource": "api-service"},
)

Use policy-as-code for access control:

from policy_as_code import PolicyEngine, Decision

def require_approval(ctx: dict) -> Decision:
    if ctx.get("env") == "prod" and not ctx.get("approved"):
        return Decision(allow=False, reason="Production requires approval")
    return Decision(allow=True, reason="ok")

engine = PolicyEngine()
engine.add_rule(require_approval)

The default implementations use in-memory storage which is:

• Not persistent: Data is lost on restart
• Not encrypted: Suitable for development only
• Not distributed: Single-process only

For production, integrate with:

• Redis/Memcached for distributed caching
• Vault/KMS for secrets
• PostgreSQL/MongoDB for persistent storage

The base modules do not include built-in authentication. Integrate with:

• OAuth 2.0 / OpenID Connect
• SAML for enterprise SSO
• mTLS for service-to-service auth

• Use TLS/SSL for all network communication
• Implement network segmentation
• Use firewalls and security groups
• Enable VPC peering where appropriate

Regular dependency updates are critical:

# Check for vulnerabilities
pip install safety
safety check

# Update dependencies
pip install --upgrade <package>

• All secrets stored in secure vault (not environment variables or config files)
• TLS/SSL enabled for all network communication
• Rate limiting configured appropriately
• Audit logging enabled and retained
• Input validation on all user inputs
• RBAC/ABAC policies defined and enforced
• Regular security scans (SAST/DAST) configured
• Dependency vulnerability scanning automated
• Security incident response plan documented
• Regular backup and disaster recovery tested
• Monitoring and alerting configured
• Least privilege principles applied

Once a vulnerability is fixed:

1. Coordinated Disclosure: 90 days after fix is released
2. Credit: Reporter credited in security advisory (if desired)
3. CVE: CVE ID assigned for significant vulnerabilities
4. Changelog: Security fixes documented in CHANGELOG

Module security champions:

• workflow-engine: Core team
• security-guardrails: Security team
• secrets-identity-fabric: Security team
• audit-first-automation: Compliance team

• OWASP Top 10
• CWE/SANS Top 25
• Python Security Best Practices

Thank you for helping keep Automation-Foundry secure!