Security Policy

We take the security of Purple8 Hyper Graph seriously. This page explains how to report vulnerabilities and what to expect from our response process.

---

Supported Versions

Version	Status
0.72.x	✅ Current release — actively supported
< 0.72	❌ Upgrade to 0.72.0 recommended

---

Reporting a Vulnerability

Do NOT open a public GitHub issue

Public disclosure of a security vulnerability puts all users at risk. Please report vulnerabilities privately using the process below.

How to report

Email us at:

📧 security@purple8.ai

Include the following in your report:

Field	Description
Description	What the vulnerability is
Reproduction steps	Minimal steps to trigger it
Impact	What an attacker could achieve
Affected versions	Which versions are affected (if known)
Suggested fix	Optional, but appreciated

What to expect

Step	Timeline
Acknowledgement	Within 48 hours of your report
Assessment & status update	Within 5 business days
Patch for critical issues	Target: within 14 days
Coordinated disclosure	We will coordinate timing with you

Recognition

We gratefully acknowledge security researchers who report vulnerabilities responsibly. With your permission, we will credit you in the release notes and CHANGELOG.

---

Security Architecture

Purple8 Hyper Graph (v0.72.0) is safe by design, by default — encryption, authentication, RBAC, multi-tenancy, and autonomous threat detection are built into the core process from the first GraphEngine() instantiation:

Storage Durability & Encryption at Rest

• Crash-safe WAL (BrickWAL) — write-ahead log entries are fdatasync'd to disk before mutations are applied to BrickCoreStorage (Purple8 Cortex)
• Envelope encryption — AES-256-GCM encryption at rest with Data Encryption Keys (DEKs) held in memory only and wrapped by your Key Management Service
• 5 KMS providers — Local keystore, HashiCorp Vault, AWS KMS, GCP Cloud KMS, and Azure Key Vault (kms.py)
• Zero-downtime key rotation — rotate master keys and re-wrap DEKs without service interruption

For details, see the Encryption & KMS Guide.

Authentication, RBAC & Multi-Tenancy

• JWT & API-key authentication — all REST, GraphQL, and MCP endpoints are authenticated by default
• 4-tier RBAC — viewer, editor, admin, and super_admin enforced uniformly across REST routes and all 125 MCP tools across 16 namespaces
• Human-only MCP safety gates — destructive or sensitive tools (such as graph.retract_statement and admin.smtp_configure) enforce strict human-in-the-loop JWT verification
• Multi-tenant isolation — shared key-prefix isolation or dedicated per-tenant storage paths (tenancy.py) with per-tenant fair-queuing write admission (write_admission.py)

Autonomous SOC & Defensive Design

• Built-in SOC vertical — real-time anomaly detection (detector.py), behavioural agent profiling (agent_profiler.py), automated containment (containment.py), and self-healing (healing.py)
• Traversal depth caps — P8G_MAX_TRAVERSE_DEPTH (default: 10) prevents graph-expansion DoS attacks
• Formal query parsing — all Cypher and AEC queries are validated through formal Lark grammars before execution
• Red Hat UBI9 / OpenShift hardening — Dockerfile.rhel runs as an arbitrary non-root UID with group 0 permissions for OpenShift SCC compliance
• License & binary integrity — HMAC-SHA256 signed manifests verify compiled module integrity at startup

---

Contact

Channel	Address
Security reports	security@purple8.ai
General enquiries	hello@purple8.ai
Enterprise	enterprise@purple8.ai