Bondry is in pre-alpha development and has not had a security audit. Do not use it to protect production credentials or expose production capabilities yet.
Report vulnerabilities privately through GitHub's private vulnerability reporting for bondry-dev/bondry. Do not open a public issue for a suspected vulnerability.
- Access is denied unless an explicit policy grants it.
- Authentication and authorization are separate decisions.
- Credentials are handled by authentication adapters and are not part of core invocation data.
- Audit events contain identifiers and outcomes, not credentials or request and response payloads.
- Network listeners default to local-only operation in adapters that provide them.