Secure Software Development Policy

Purpose and scope

This policy describes how RODMENA LIMITED develops software securely — for our own products (including the Highway workflow engine) and for customer engagements.

Practices

• Version control: all code lives in Git with a reviewable history; changes are made through commits that can be audited and reverted.
• Secrets: credentials, keys and tokens are never committed to repositories; they are stored in appropriate secret storage and rotated when exposure is suspected.
• Dependencies: we minimise third-party dependencies by design, pin versions, and update promptly when security advisories are published.
• Review and testing: changes are tested before release; failure modes are treated as design inputs — our platforms are built so that crashes cannot produce partial state.
• Least privilege by design: products support role-based access control and tenant isolation (for example PostgreSQL row-level security).
• Data in development: production personal data is not used in development or testing environments.
• Release: deployments are repeatable and reversible; production changes are verified after release.

Vulnerability handling

Vulnerabilities in our software — found internally or reported through our responsible-disclosure route — are triaged by severity, fixed promptly, and disclosed responsibly to affected customers.

Responsibilities

The Director owns this policy. It is reviewed at least annually and whenever our toolchain changes materially.