Skip to content

Enterprise diligence

Short diligence sheet for security, procurement, and architecture reviewers. Capability maturity: What’s ready (summary) · What’s ready — evidence (matrices). Fit: Evaluate Hedron · Ops: Ship a Hedron app · Design principles · Non-goals.

Project facts

Item Value
License MIT
Current version Published v1.1.2; recommended application range hedron>=1.1.2,<1.2
Publication / commercial SLA Hedron 1.1.2 and Edron 1.1.2 are on PyPI; no commercial SLA
Support Community GitHub Issues only — Support
Governance / maintainers Maintainer-led public governance; current authority is the PyPI maintainer and GitHub administrator roster — Governance
Security disclosure GitHub security advisories (preferred); alternate email in SECURITY.md
Conduct reports Not security advisories — see Code of Conduct

Trust boundaries

  • Hedron provides secure HTML defaults (escaping, CSRF profiles, SafeUrl/TrustedHtml).
  • You own authentication, authorization, persistence, and multi-tenant isolation.
  • There is no first-party IdP / managed SSO product — host frameworks own identity. Optional FastAPI helpers (hedron.oidc, hedron.security login CSRF / session stamps / auth rate limit / trusted headers) exist; apps must wire them (Authentication, Hardened sessions).
  • Tenant-scoped caches, jobs, and fragment allowlists are application responsibility — see Threat model, Cache, and the multi-tenant cookbook.
  • Third-party plugins are out of security scope until you review them (Using plugins · Plugin authoring).
  • Host-framework CVEs (FastAPI, Django, Flask) are reported upstream.

Multi-tenant checklist (you own)

  • [ ] Cache keys include tenant (or use no-store / private per-user scopes)
  • [ ] Job backends authorize by tenant before status SSE/poll
  • [ ] Fragment regions and OOB targets cannot leak cross-tenant HTML
  • [ ] Session cookies and CSRF secrets are per-environment; never shared across tenants

Dependency and pin policy

  • Coordinate on published trains. Use hedron>=1.1.2,<1.2 for the current application range, then commit a lockfile; use ==1.1.2 for exact evidence reproduction.
  • Runtime ranges and conflict guidance: COMPATIBILITY.md (FastAPI/Pydantic pins are intentionally tight).
  • Patch expectation: community best-effort; critical security fixes are prioritized on the current train. There is no contractual patch SLA.

Claims we never make

Hedron documentation and marketing do not claim:

  • Commercial SLA or guaranteed patch cadence
  • WCAG / legal / VPAT / ACR certification for your application
  • Managed IdP / SSO product (optional helpers only — you own identity)
  • SLSA product attestation or commercial compliance certification
  • That every hedron[extras] widget is production-complete (CodeEditor is a host stub; TerminalView / device bridges are Experimental)

Trust-program priorities that close diligence caveats without inventing those claims: Ship a Hedron app · What's ready.

Compliance positioning (not certification)

Hedron is a library, not a hosted service. For GDPR / SOC 2 / HIPAA-style programs:

Hedron provides You own
Escaping defaults, CSRF profiles, SafeUrl / TrustedHtml AuthN/AuthZ, retention, DPIAs, BAAs
Secure-defaults docs + optional evidence pack / SBOM scripts Lockfiles, deploy controls, access reviews
Honest maturity labels (Beta, experimental live) Choosing Supported surfaces and pins

Hedron is not SOC 2 / ISO / HIPAA certified. Slot it into your control framework as third-party open-source software with pinned versions and your own threat model review.

Supply-chain evidence

Prefer GitHub Release assets for the selected published version (SBOM, license, and evidence bundle) when they are attached. Do not treat an unreleased repository checkout as a published artifact. If an evidence asset is missing, regenerate it from the immutable tag and record that it is locally generated rather than maintainer-published. PyPI remains authoritative for package versions.

Verify the package independently in a clean directory:

python -m pip download --only-binary=:all: "hedron==1.1.2"
python -m pip hash hedron-1.1.2-*.whl

Compare the recorded digest with your artifact store or an attached release checksum when one exists. Maintainers should attach evidence bundles on release day when publishing a train tag; absence of such an attachment is a diligence caveat, not proof that one was published.

Evidence honesty

Live SSE/WebSocket APIs ship on FastAPI; full multi-engine live browser matrix and load/proxy backpressure rows remain incomplete — see What's ready. Treat “Supported” as capability claims with those caveats, not as a warranty.

Accessibility posture

Hedron documents author checklists and component contracts (Accessibility). There is no WCAG conformance claim for your application — you own audits and remediation.

Bus factor

Expect a small maintainer set. Diligence should assume community-paced response times, pin versions accordingly, and review the succession process.