Skip to content

Trust & Security

How do you know installing this is safe?

That's the real question a security review is checking for — not "is the code good," but "did an attacker get between you and this package." A supply-chain attack doesn't target you directly: it compromises a dependency, a build pipeline, or a maintainer's account so malicious code rides along inside an otherwise ordinary pip install. It's the same class of risk behind incidents like the XZ Utils backdoor — the install looks routine; the payload isn't.

The gaspatchio package itself makes no network calls at all — every projection runs on your machine, against your data, with nothing sent anywhere. It's open source, every release carries a verifiable record of exactly what's in it and how it was built, and the full dependency tree is scanned continuously for known vulnerabilities and disallowed licenses.

Send the section below to whoever asked — it's written for them to verify all of that directly, not take our word for it.

For security teams

What ships

Gaspatchio is Apache-2.0 / MIT dual-licensed and source-visible on GitHub at gaspatchio/gaspatchio. Every file carries an SPDX license header, verified on every pull request by REUSE 3.3 compliance checks.

Network activity

The gaspatchio package installed from PyPI makes no network calls — no telemetry, no license check, no update ping. A projection runs entirely against local data.

The optional AI plugin adds two things:

  • Editor skills (model building, reconciliation, and similar) run entirely inside your own already-configured AI coding tool — Claude Code, GitHub Copilot, or Cursor. Gaspatchio operates no service in that path.
  • gspio docs and gspio knowledge — two CLI commands that search framework documentation and an actuarial knowledge base — send the typed query over HTTPS to a hosted search API. That service does not retain the query text, search results, or any generated answer; it logs only operational metadata (endpoint, result count, latency, model, token count) for service analytics. Both commands are opt-in — nothing else in the plugin talks to this service.

Software bill of materials

Every release ships a CycloneDX SBOM (sbom.cdx.json, covering the Rust and Python dependency graphs) as a GitHub Release asset:

gh release download <tag> --repo gaspatchio/gaspatchio --pattern 'sbom.cdx.json'

Build provenance

Wheels published to PyPI carry PEP 740 build-provenance attestations, generated automatically through PyPI Trusted Publishing — each wheel traces back to the exact GitHub Actions run and commit that built it, not a maintainer's machine. The attestation is visible on the release's PyPI file listing.

Dependency management

Rust dependencies are pinned exactly via a committed Cargo.lock, so every build resolves an identical dependency graph. Python dependencies use compatible-release version ranges — standard practice for a library rather than an application — and the exact versions resolved for any given release are captured in that release's SBOM, not left to guesswork.

  • Dependabot opens a grouped pull request weekly for Rust, Python, and GitHub Actions dependency updates.
  • OSV-Scanner runs on every pull request and on a weekly schedule, checking both the Rust and Python dependency graphs against newly published CVEs.
  • A license-compliance gate audits the full runtime dependency closure — Python wheel and Rust crate — on every pull request, and fails the build on GPL, AGPL, SSPL, or BUSL-licensed dependencies entering the tree.

Commit signing

main is protected by a ruleset requiring every commit to be signed — enforced by GitHub, not just documented.

Supported versions

Gaspatchio is pre-1.0. Security fixes are released against the latest version published on PyPI — there is no older maintained branch to backport to. Always track the latest release.

Vulnerability disclosure

Report a vulnerability privately through GitHub's private reporting or by emailing [email protected]. New reports are acknowledged within 2 business days, with an initial assessment within 7. Confirmed issues are published as GitHub Security Advisories once a fix ships. Full policy: SECURITY.md.