pyegeria is part of the ODPi Egeria project family and follows Egeria's own code quality and security practices, including:

• GitHub Dependabot to automatically update dependencies (.github/dependabot.yml).
• GitHub CodeQL to automatically scan for security vulnerabilities (.github/workflows/codeql.yml).
• PyPI Trusted Publishing (OIDC) for releases — no long-lived API token is stored in this repository.
• GitHub Actions steps pinned to a specific commit SHA rather than a mutable tag, so a workflow can't be silently altered by a tag being moved upstream.

If you believe you've found a security vulnerability in pyegeria, please report it privately rather than opening a public issue:

• Use GitHub's private vulnerability reporting for this repository, or
• Email egeria-security@lists.lfaidata.foundation.

For general questions about this policy, reach out to the Egeria development team.

License: CC BY 4.0, Copyright Contributors to the ODPi Egeria project.