Production Safety
What PRODUCTION_SAFE permits and forbids, which proofs belong in local or staging fixtures, and how evidence retention is classified and redacted.
The rule
PRODUCTION_SAFE mode permits non-destructive evidence gathering and bounded verification only. The adapter safety layer enforces the same boundary in tooling: production and uncontrolled scan contexts fail closed rather than degrading to a permissive default.
What moves to fixtures
If a test could mutate any of the following, it requires explicit authorization or it moves to local and staging fixtures.
- Money.
- Identity.
- Inventory.
- Authorization state.
- External provider state.
- Customer data.
- Anything deletable, exhaustible, or irreversible.
The preferred proof methods stay the same across modes: purpose-built fixtures, two-account and two-role comparisons, browser automation against local or staging, exact response and status assertions, concurrency tests with harmless fixture state, dependency and static scanners, local proxy inspection, and provider mocks.
Audit events
SecHelix audit data can contain security-sensitive architecture, rejected hypotheses, employee identity, source excerpts, and remediation history. It is controlled security data, not ordinary build output. Record append-only events for:
- Scope creation and changes.
- Applicability decisions and overrides.
- Evidence ingestion, with source and digest.
- Verifier assignment and classification.
- Finding severity, status, and resolution changes.
- Fix and regression evidence.
- Accepted-risk creation, approval, expiration, and revocation.
- Policy-pack version changes.
- Gate decisions.
- Report and bundle generation, access, export, and deletion.
Never put raw tokens, private keys, session cookies, seed phrases, or complete production payloads in audit metadata.
Retention classes
| Class | Examples | Default direction |
|---|---|---|
| Ephemeral working data | Raw scanner output, temporary source slices | Delete after normalization or verification unless an active case needs it |
| Release evidence | Canonical report, gate decision, regression proof | Keep for the supported release lifetime plus the audit window |
| Accepted risk | Approval, rationale, compensating controls | Keep through expiration and review history |
| Security incident or legal hold | Evidence explicitly placed on hold | Follow the authorized hold; suspend deletion only for scoped records |
| Benchmark data | Synthetic fixtures and measured run metadata | Retain for reproducibility; never mix in customer source |
Integrity and access
- Least privilege
- Separate evidence writers from policy and risk approvers.
- Encryption
- Encrypt stored evidence and transport with organization-approved controls.
- Immutability
- Prefer immutable or append-only storage for final gate decisions.
- Export control
- Record export and access events, and rate-limit bulk exports.
- Digests
- Hash final artifacts and record the digest in the audit event.
- Restoration
- Test restoration and deletion, including backups.
- Redaction before indexing
- Redact before evidence reaches search or observability systems.
Signed evidence bundles can improve tamper detection, but they do not prove the audit was complete or that the original finding was correct. Signing is an integrity control, not a verification result.