Scope
This policy applies to all botBrains source code, infrastructure-as-code, and configuration that builds or runs the customer service AI product. It covers both team members and any contracted developer.Secure development lifecycle
botBrains follows a lightweight, iterative lifecycle suited to a two-person remote team. Each change moves through the same stages.
Secure engineering principles apply throughout: least privilege, defence in depth, logical multi-tenant isolation by tenant ID, and secure defaults. botBrains protects account and conversation data per the Data Classification Policy.
Source code and secret handling
botBrains hosts all source code in private GitHub repositories. The platform restricts access by role and protects it with multi-factor authentication, as defined in the Access Control Policy. botBrains never commits secrets such as API keys, database credentials, and signing keys to source control. If a secret is ever committed, botBrains rotates it immediately and handles the exposure under the Incident Management Policy. The platform injects secrets at deploy time through environment variables and provider secret stores, and the team shares them through the company password manager. The Cryptography Policy defines encryption standards for the data the application handles.Dependency scanning
Automated dependency scanning (Dependabot) continuously monitors third-party dependencies on the GitHub repositories. botBrains triages and remediates findings through the Vulnerability Management Policy, which sets severity-based remediation timelines.Code review and change approval
botBrains operates as a small team, which makes a mandatory independent second approval on every change impractical today. We treat this as a known segregation-of-duties gap and apply compensating controls rather than claim a control we don’t run.
botBrains intends to make pull-request review with a second approval mandatory as the team grows. Change management for production is governed by the Operations Security Policy.