Fixes ship in the next release cut from dev. There are no maintenance branches and older minors are not backported, so "supported" means the most recent release on PyPI.

Note that v1 is this repository, fraiseql-python. The separate v2 project (fraiseql/fraiseql) has its own security policy; report v2 issues there.

We take security vulnerabilities seriously. If you discover a security issue, please follow these steps:

Please do not report security vulnerabilities through public GitHub issues.

Report via GitHub Security Advisories: Create a Security Advisory

If you prefer email, send details to: security@fraiseql.dev (response may be delayed)

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity

FraiseQL includes several built-in security features:

All queries use parameterized statements:

# Safe - parameters are properly escaped
repo.find("users_view", email=user_input)

Support for Auth0 and custom providers:

from fraiseql.auth import Auth0Provider

auth = Auth0Provider(
    domain="your-domain.auth0.com",
    audience="your-api"
)

Control access at the field level:

@fraiseql.field
@requires_auth
@requires_permission("read:sensitive_data")
def sensitive_field(user: User, info: Info) -> str:
    return user.sensitive_data

Prevent resource exhaustion:

from fraiseql import ComplexityConfig

config = ComplexityConfig(
    max_complexity=1000,
    max_depth=10
)

Built-in rate limiting support:

from fraiseql.auth import RateLimitConfig

rate_limit = RateLimitConfig(
    requests_per_minute=100,
    burst=20
)

Automatic CSRF token validation:

from fraiseql import FraiseQLConfig

config = FraiseQLConfig(
    csrf_protection=True
)

Disable introspection in production:

config = FraiseQLConfig(
    introspection_enabled=False  # Disable in production
)

Never commit secrets:

# Use environment variables
DATABASE_URL = os.getenv("DATABASE_URL")
SECRET_KEY = os.getenv("SECRET_KEY")

Always use HTTPS in production:

app.add_middleware(
    HTTPSRedirectMiddleware
)

Use least-privilege principle:

-- Read-only user for queries
CREATE USER fraiseql_reader WITH PASSWORD 'secure_password';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO fraiseql_reader;

Validate all user inputs:

from pydantic import BaseModel, EmailStr

class UserInput(BaseModel):
    email: EmailStr  # Validated email
    age: int  # Type validation

Keep dependencies up to date:

pip list --outdated
pip install --upgrade fraiseql

Enable audit logs for sensitive operations:

from fraiseql.enterprise.audit import AuditLogger

audit = AuditLogger()
audit.log_mutation("update_user", user_id=123)

Check the Security Advisories page for known vulnerabilities.

When we receive a security report:

1. We confirm the issue
2. We develop a fix
3. We prepare a security advisory
4. We release the fix
5. We publicly disclose the issue

We aim to coordinate disclosure with the reporter.

Subscribe to security announcements:

• Watch the GitHub repository
• Follow our security mailing list
• Check release notes for security fixes

FraiseQL depends on several packages. We monitor security advisories for:

• FastAPI
• Strawberry GraphQL
• PostgreSQL drivers
• Authentication libraries

FraiseQL can help meet compliance requirements:

• GDPR: Field-level data access control
• SOC 2: Audit logging and access controls
• HIPAA: Encryption and access controls

Contact us for compliance documentation.

For security questions that aren't vulnerabilities:

• Open a GitHub discussion
• Email: security@fraiseql.dev

Thank you for helping keep FraiseQL secure!