...

This section describes how the project maintains supply chain and code security internally.

All dependencies are locked via uv.lock, which records exact versions and hashes for every package in the dependency tree. This ensures fully reproducible installs and protects against silent dependency changes.

uv sync   # installs exact versions from uv.lock

Direct dependencies are pinned to exact versions using the == specifier in pyproject.toml. This prevents unintended upgrades during environment setup.

[project]
dependencies = [
    "httpx==0.27.0",
    "pydantic==2.7.1",
]

The uv.toml configuration uses the exclude-newer parameter to prevent resolving packages published after a specified date. This reduces exposure to recently introduced malicious or broken packages.

[pip]
exclude-newer = "14 days"

Dependencies should be regularly audited for known CVEs using uv audit:

uv audit

It is recommended to run uv audit as part of CI on every pull request.

The project uses Ruff with the S (flake8-bandit) ruleset enabled in ruff.toml to catch common security anti-patterns at lint time.

[lint]
select = ["S"]

This covers issues such as hardcoded secrets, unsafe deserialization, shell injection risks, and use of deprecated cryptographic functions.

It is recommended to enforce linting rules in CI on every pull request.

If a requirements.txt file is needed (e.g. for deployment or tooling that does not support uv.lock), it must always be generated directly from uv.lock — never maintained by hand or produced via pip freeze.

# create/update requirements.txt
uv sync
uv export --locked --format requirements-txt --no-dev --output-file requirements.txt

This guarantees that requirements.txt is always consistent with the locked dependency tree, including verified hashes.