Skip to content
Zoos GlobalZoos GlobalZoos EngineeringHub

Security Policy

Security guidelines and standards at Zoos Global.

stablePolicybeginnersecuritycompliance
1 min readUpdated Jul 24, 2026@security-teamSecurity
Edit source

This document outlines the security requirements and expectations for all Zoos Global employees, particularly those handling source code and infrastructure.

Data Classification

Section titled “Data Classification”

We categorize our data into three tiers:

  • Public: Information suitable for public release (e.g., promotional material, open-source code).
  • Internal: Standard company operational data (e.g., documentation, internal tools).
  • Restricted: Highly sensitive data including customer PII, database credentials, encryption keys, and proprietary source code.

Code Security

Section titled “Code Security”
  1. Secret Management: Hardcoding passwords, API tokens, or secrets in repository code is strictly prohibited. Use AWS Secrets Manager, SSM Parameter Store, or Vault, and inject them via environment variables at runtime.
  2. Dependency Audits: We run automated vulnerability scanning on dependencies weekly. Any dependencies with critical vulnerability reports must be upgraded immediately.

Incident Reporting

Section titled “Incident Reporting”

If you suspect a security breach, credential leak, or unauthorized access:

  • Immediately notify the security team via the #security-incident channel on Slack.
  • Do not paste credentials or leaked data into public slack channels. Use secure one-time sharing portals.