Security Policy
We take the security of Purple8 Hyper Graph seriously. This page explains how to report vulnerabilities and what to expect from our response process.
Supported Versions
| Version | Status |
|---|---|
| 0.27.x | ✅ Current release — actively supported |
| < 0.27 | ❌ No longer supported |
Reporting a Vulnerability
Do NOT open a public GitHub issue
Public disclosure of a security vulnerability puts all users at risk. Please report vulnerabilities privately using the process below.
How to report
Email us at:
Include the following in your report:
| Field | Description |
|---|---|
| Description | What the vulnerability is |
| Reproduction steps | Minimal steps to trigger it |
| Impact | What an attacker could achieve |
| Affected versions | Which versions are affected (if known) |
| Suggested fix | Optional, but appreciated |
What to expect
| Step | Timeline |
|---|---|
| Acknowledgement | Within 48 hours of your report |
| Assessment & status update | Within 5 business days |
| Patch for critical issues | Target: within 14 days |
| Coordinated disclosure | We will coordinate timing with you |
Recognition
We gratefully acknowledge security researchers who report vulnerabilities responsibly. With your permission, we will credit you in the release notes and CHANGELOG.
Security Architecture
Purple8 Hyper Graph is designed with security as a core principle:
Encryption
- Encryption at rest — AES-256-GCM envelope encryption for all stored data
- KMS integration — AWS KMS, Azure Key Vault, GCP Cloud KMS, and HashiCorp Vault
- Zero-downtime key rotation — rotate encryption keys without service interruption
For details, see the Encryption & KMS Guide.
Authentication & Authorisation
- JWT authentication — all API endpoints are authenticated by default (HMAC-SHA256)
- RBAC & multi-tenancy — strict tenant isolation with role-based access control
- No plaintext secrets — sensitive configuration is always loaded from environment variables or secret stores
Defensive design
- Traversal depth caps —
P8G_MAX_TRAVERSE_DEPTH(default: 10) prevents graph-expansion DoS attacks - Rate limiting — built-in request rate limiting with configurable thresholds
- Input validation — all Cypher queries are parsed through a formal Lark grammar before execution
- License integrity — HMAC-SHA256 signed manifests prevent tampering with compiled modules
Contact
| Channel | Address |
|---|---|
| Security reports | security@purple8.ai |
| General enquiries | hello@purple8.ai |
| Enterprise | enterprise@purple8.ai |