Security Policies
This page is a working draft and is pending review before release.
Detection policies
SecureFlow ships with policy templates covering parameterized queries, PII logging, SSRF, CORS, unsafe deserialization, weak hashing, public cloud storage, container privileges and smart contract reentrancy. Each can be toggled per user or organisation from the policy dashboard.
Manage policiesPrompt injection defence
Because scanning sends untrusted code to a language model, the scanner applies policy isolation boundaries and pre-filtering before the model sees a diff. The threat model and controls are documented in the repository.
Read the prompt injection documentationReporting a vulnerability
If you find a security issue in SecureFlow itself, please report it privately rather than opening a public issue, so it can be fixed before disclosure.
Open a private security advisory