Secure Software Development Policy
Purpose and scope
This policy describes how RODMENA LIMITED develops software securely — for our own products (including the Highway workflow engine) and for customer engagements.
Practices
- Version control: all code lives in Git with a reviewable history; changes are made through commits that can be audited and reverted.
- Secrets: credentials, keys and tokens are never committed to repositories; they are stored in appropriate secret storage and rotated when exposure is suspected.
- Dependencies: we minimise third-party dependencies by design, pin versions, and update promptly when security advisories are published.
- Review and testing: changes are tested before release; failure modes are treated as design inputs — our platforms are built so that crashes cannot produce partial state.
- Least privilege by design: products support role-based access control and tenant isolation (for example PostgreSQL row-level security).
- Data in development: production personal data is not used in development or testing environments.
- Release: deployments are repeatable and reversible; production changes are verified after release.
Vulnerability handling
Vulnerabilities in our software — found internally or reported through our responsible-disclosure route — are triaged by severity, fixed promptly, and disclosed responsibly to affected customers.
Responsibilities
The Director owns this policy. It is reviewed at least annually and whenever our toolchain changes materially.