Secure Software Development Policy
Purpose and scope
This policy describes how RODMENA LIMITED develops software securely, both for our own products (including the Highway workflow engine) and for customer engagements.
Practices
- Version control: all code lives in Git with a reviewable history, and changes are made through commits that can be audited and reverted.
- Secrets: credentials, keys and tokens are never committed to repositories. They are kept in appropriate secret storage and rotated when exposure is suspected.
- Dependencies: we keep third-party dependencies to a minimum, pin versions and update promptly when security advisories are published.
- Review and testing: changes are tested before release. We design for failure from the start, and our platforms are built to make partial state after a crash impossible.
- Least privilege by design: products support role-based access control and tenant isolation (for example PostgreSQL row-level security).
- Data in development: production personal data is not used in development or testing environments.
- Release: deployments are repeatable and reversible, and production changes are verified after release.
Vulnerability handling
Vulnerabilities in our software, whether found internally or reported through our responsible-disclosure route, are triaged by severity, fixed promptly and disclosed responsibly to affected customers.
Responsibilities
The Director owns this policy. It is reviewed at least annually and whenever our toolchain changes materially.