Flaxon 0.3.0 and Teloce-Py 0.3.0 are available on PyPI. Release instructions are maintained on this site; source links identify the framework snapshot. Check version and upgrade guidance.

Framework source · Markdown

Security Policy

Supported Versions

Flaxon follows a security-focused maintenance policy. The current 2.x release series is the primary supported version.

Security fixes will be prioritized for the actively supported release series.

Reporting a Vulnerability

We take security vulnerabilities seriously.

If you discover a security vulnerability in Flaxon:

1. DO NOT open a public GitHub issue.
2. Email the maintainer at aldanehutchinson5@gmail.com.
3. Include as much of the following information as possible:
4. Flaxon version
5. Python version
6. Operating system
7. Step-by-step reproduction
8. Expected behavior
9. Actual behavior
10. Potential security impact
11. Suggested fix, if available

We aim to acknowledge vulnerability reports within 48 hours and will investigate and address confirmed vulnerabilities as quickly as practical.

Security Best Practices

Production Deployment

When deploying a Flaxon application to production:

• Never enable debug=True in production.
• Use a strong SECRET_KEY generated from a secure random source.
• Configure ALLOWED_HOSTS for the application's expected domains.
• Terminate TLS using HTTPS at a trusted reverse proxy or load balancer.
• Store secrets in environment variables or an appropriate secrets manager.
• Keep Flaxon and its dependencies updated.
• Run production applications with the minimum required permissions.

Environment Variables

Example production configuration:

```env FLAXON_ENV=production FLAXON_DEBUG=false FLAXON_SECRET_KEY= FLAXON_ALLOWED_HOSTS=api.example.com,example.com