Comprehensive security documentation for the cachekit Python SDK.

• Supported Versions
• Reporting a Vulnerability
• Architecture Overview
• Python SDK Security Features
• FFI Boundary Security
• Supply Chain Security
• CI/CD Security
• Known Limitations
• Security Roadmap

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact
• Suggested fix (if available)

┌─────────────────────────────────────────────────────────────────┐
│                     cachekit Python SDK                         │
│  ┌──────────────┐  ┌──────────────┐  ┌───────────────────────┐  │
│  │   @cache     │  │   @cache     │  │   Redis/CachekitIO    │  │
│  │  Decorator   │  │   .secure    │  │      Backend          │  │
│  └──────┬───────┘  └──────┬───────┘  └───────────┬───────────┘  │
│         │                 │                      │              │
│         └────────┬────────┴──────────────────────┘              │
│                  │                                              │
│         ┌────────▼────────┐                                     │
│         │   PyO3 FFI      │  ◄── This repo                      │
│         │   Wrapper       │                                     │
│         └────────┬────────┘                                     │
└──────────────────┼──────────────────────────────────────────────┘
                   │
         ┌─────────▼─────────┐
         │   cachekit-core   │  ◄── Separate crate
         │  ┌─────────────┐  │
         │  │ AES-256-GCM │  │
         │  │ LZ4 Compress│  │
         │  │ xxHash3     │  │
         │  │ HKDF        │  │
         │  └─────────────┘  │
         └───────────────────┘

This document focuses on Python SDK-specific security: FFI boundary, configuration, and Python-layer tooling.

We use MessagePack (safe binary serialization) with type preservation via schema metadata.

- import pickle  # NEVER - arbitrary code execution
+ import msgpack  # Safe binary serialization

When enabled via @cache.secure, client-side AES-256-GCM encryption ensures the server never sees plaintext:

All sensitive values are automatically masked:

Implementation: Uses pydantic-settings with SecretStr for automatic redaction.

When using @cache.io (CachekitIOBackend), the SDK includes built-in Server-Side Request Forgery (SSRF) protection. Custom API URLs are blocked by default - only api.cachekit.io and its subdomains are permitted.

See SSRF Protection for full details, including custom host configuration for development environments.

# One-time setup
make security-install

# Quick checks (< 3 min)
make security-fast

# Comprehensive (< 15 min)
make security-medium

# Python dependencies
make security-audit

# Generate report
make security-report

Reports are archived in reports/security/ for compliance and audit trails.

SDK Responsibilities:

• Safely calling cachekit-core via FFI
• Protecting master keys in memory (SecretStr)
• Preventing key leakage in logs/errors
• Validating inputs before FFI calls

For cryptographic guarantees, see:

• cachekit-core Cryptographic Security
• cachekit-core Kani Verification

Security patches are backported to the latest supported version.

We appreciate responsible disclosure from the security community. Security researchers who report valid vulnerabilities will be acknowledged in release notes (with permission).