We provide security updates for the following versions:

If you discover a security vulnerability in the Itential Python SDK, please report it responsibly:

1. Do not create a public GitHub issue
2. Report the vulnerability using one of these methods:
   • Preferred: Use GitHub Security Advisories to report privately
   • Alternative: Email security details to the maintainers at security@itential.com
3. Include the following information:
   • Description of the vulnerability
   • Steps to reproduce the issue
   • Affected versions
   • Potential impact assessment
   • Any suggested fixes or mitigations

We will respond to security reports within 48 hours and provide regular updates on our progress. Once a fix is available, we will coordinate disclosure timing with you.

• Never hardcode credentials in your source code
• Use environment variables or secure credential management systems
• Rotate authentication tokens regularly
• Use OAuth with client credentials flow when available (Platform connections)
• Store credentials with appropriate file permissions (600 or restrictive)

# Good: Use environment variables
import os
from ipsdk import platform_factory

client = platform_factory(
    host=os.getenv("ITENTIAL_HOST"),
    username=os.getenv("ITENTIAL_USERNAME"),
    password=os.getenv("ITENTIAL_PASSWORD")
)

# Bad: Hardcoded credentials
client = platform_factory(
    host="https://production.example.com",
    username="admin",
    password="secret123"
)

• Always use HTTPS in production environments
• Never disable certificate verification unless absolutely necessary for development
• Use proper CA certificates and validate certificate chains
• Configure appropriate TLS versions (1.2+)

# Good: Secure TLS configuration
client = platform_factory(
    host="https://itential.example.com",
    username=username,
    password=password,
    verify_certs=True,  # Default: always verify certificates
    timeout=30
)

# Bad: Disabled certificate verification
client = platform_factory(
    host="https://itential.example.com",
    username=username,
    password=password,
    verify_certs=False  # Only for development/testing
)

• Use network segmentation and firewalls to restrict access
• Implement proper timeout values to prevent hanging connections
• Use connection pooling appropriately
• Monitor and log API access patterns

• Handle exceptions properly without exposing sensitive information
• Sanitize error messages before logging or displaying
• Use structured logging with appropriate log levels
• Avoid logging sensitive data (credentials, tokens, personal information)

import logging
from ipsdk import logger

# Configure logging securely
logger.set_level("INFO")  # Avoid DEBUG in production

try:
    response = client.get("/api/data")
except Exception as e:
    # Good: Log error without sensitive details
    logging.error("API request failed: %s", str(e))

    # Bad: Don't log full request details that might contain secrets
    # logging.error("Request failed: %s", request.json)

• Validate all input parameters
• Sanitize data before sending to APIs
• Use parameterized queries and avoid string concatenation
• Implement rate limiting for API calls

# Good: Validate input parameters
def get_user_data(user_id):
    if not isinstance(user_id, (int, str)) or not user_id:
        raise ValueError("Invalid user_id")

    # Sanitize user_id if needed
    safe_user_id = str(user_id).strip()

    return client.get(f"/users/{safe_user_id}")

• Regularly update dependencies to patch security vulnerabilities
• Use dependency scanning tools in CI/CD pipeline
• Pin dependency versions in production
• Monitor security advisories for httpx and other dependencies

# Check for security vulnerabilities
uv run bandit -r src/ipsdk --configfile pyproject.toml
make security

# Keep dependencies updated
uv sync --upgrade

• Use pre-commit hooks to catch potential security issues
• Run security scans in CI/CD pipeline
• Implement code review processes
• Use static analysis tools (bandit, ruff security rules)

# Install pre-commit hooks
uv run pre-commit install

# Run security analysis
make security
make premerge  # Includes security checks

When using async connections:

• Properly manage async context managers and resource cleanup
• Use appropriate timeout values for async operations
• Handle async exceptions properly
• Avoid blocking the event loop with synchronous operations

# Good: Proper async resource management
async def secure_async_call():
    async with gateway_factory(
        host=host,
        username=username,
        password=password,
        want_async=True
    ) as client:
        response = await client.get("/api/data")
        return response

• Use secrets management systems (Kubernetes secrets, AWS Secrets Manager, etc.)
• Implement proper monitoring and alerting
• Use least-privilege access principles
• Regularly audit access logs and API usage
• Implement circuit breakers and retry mechanisms with backoff

Our CI/CD pipeline includes security checks:

• Bandit: Static security analysis for Python code
• Ruff: Includes security-focused linting rules (S rule set)
• Pre-commit hooks: Catch security issues before commits
• Dependency scanning: Monitor for vulnerable dependencies

When testing the SDK:

• Use test credentials and isolated test environments
• Never use production credentials in tests
• Implement security-focused unit tests
• Test authentication failure scenarios
• Validate TLS certificate handling

The Itential Python SDK follows security best practices including:

• Secure defaults (TLS verification enabled, appropriate timeouts)
• Principle of least privilege
• Defense in depth
• Input validation and sanitization
• Secure error handling and logging