Security Policy

Owner: Security
Reviewers: Engineering, DevOps, Product
Status: Draft
Version: 0.1
Last Updated: 2026-09-16
Review Cycle: Per release

Policy

• Protect user, farm and operational data through authenticated API access.
• Enforce least privilege by role and farm scope.
• Store secrets outside source control.
• Log security-relevant operations where activity logging exists.
• Treat auth bypasses, exposed credentials and cross-farm data leaks as high severity.

Current High-Priority Gap

Temporary permission/scope bypasses in current code must be removed before production release.